IBM Bob Self-Hosted: The Complete Guide to Air-Gapped AI Coding Agents for Agentic AI Architects (2026)

On October 1, 2026, IBM made a move that every enterprise architect running regulated codebases had been waiting for: IBM Bob, the agentic AI coding platform already used by 80,000+ IBM developers internally, shipped general availability of self-hosted and air-gapped deployment. Source code no longer needs to leave the building. Models run on your GPUs. Audit trails stay in your SIEM.

This isn’t a minor packaging update. IBM Bob’s self-hosted option decouples the entire inference layer from IBM’s SaaS, letting banks, defense contractors, government agencies, and healthcare systems run a full-lifecycle agentic development platform — planning, coding, testing, modernization — inside their own firewalls, on their own infrastructure, with their own model choices. And for organizations that can tolerate hybrid connectivity, it routes workloads between on-premises inference and approved external frontier models like Claude Sonnet 5.0 and GPT 5.6 Sol on a per-project basis.

For agentic AI architects, this is the inflection point where enterprise coding agents stop being “something the cloud-native teams use” and start becoming infrastructure that compliance-heavy organizations can actually deploy. Here’s the complete breakdown.

What Is IBM Bob? The 60-Second Primer

IBM Bob is an agentic software development platform that covers the full software development lifecycle — from planning and architecture through coding, testing, deployment, and legacy modernization. Originally introduced in April 2026, it has grown from 100 internal IBM developers in June 2025 to over 80,000 by October 2026, with self-reported 45% average productivity gains across surveyed users.

Unlike single-model coding assistants (think GitHub Copilot or Cursor), Bob operates as a multi-agent, multi-model orchestration platform. It doesn’t just autocomplete code — it coordinates specialized sub-agents for planning, execution, testing, and validation, routing each task to the most appropriate foundation model based on complexity, cost, and security requirements.

Key differentiators that set Bob apart from the crowded coding-agent market:

• Multi-model routing: Tasks flow automatically to Anthropic Claude for complex reasoning, IBM Granite for lightweight completions, and Mistral for cost-efficient operations — roughly 90% of substantial tasks route to larger frontier models, while simpler completions use smaller, cheaper ones.
• Full SDLC coverage: Not just code generation — Bob handles architecture planning, test generation, security scanning, code review, CI/CD alignment, and legacy modernization.
• Enterprise governance: BobShell (the CLI interface) creates self-documenting audit trails, prompt normalization prevents injection attacks, and real-time sensitive data scanning catches credential leaks before they hit a commit.
• Legacy modernization packages: Premium packages for Java (JDK upgrades, framework migrations), IBM i (RPG/COBOL/CL), and IBM Z (COBOL/PL/I/assembler) — the kind of workloads that RPA teams encounter daily in enterprise integration projects.

Why Self-Hosted Matters: The Data Sovereignty Problem

According to IBM’s Institute for Business Value (2026), 68% of executives identify meeting data residency and sovereignty requirements as their top challenge when deploying AI across the enterprise. Futurum Research projects that hybrid and edge deployments will capture 44% of AI infrastructure spending by 2030, while public cloud’s share declines to 46%.

The problem is straightforward: most AI coding agents are SaaS-only. Your source code, your prompts, your architectural context — all of it leaves your network, gets processed on someone else’s infrastructure, and comes back. For a fintech startup, that’s fine. For a bank running COBOL on mainframes that process $4 trillion in daily transactions, it’s a non-starter.

More Read

Claudeforce: The Complete Guide for Agentic AI Architects (2026)

Top 8 Trending Open-Source Agentic AI Repos Worth Starring in 2026

Building Multi-Agent Systems with Google ADK: The Complete Step-by-Step Guide

Before October 1, IBM Bob was SaaS-only too. The self-hosted announcement changes the equation by giving enterprises three deployment patterns:

The hybrid option is particularly clever for agentic AI architects designing multi-tier security models. As IBM describes it: a single bank could “run on-premises inference for core banking applications” while routing less-restricted workloads to an approved external model — with developers experiencing the same interface and functionality regardless of where inference happens.

Architecture Deep Dive: How Self-Hosted Bob Actually Works

The self-hosted architecture decouples the Bob platform from the inference layer. Here’s how the components stack up:

The Agent Harness

At the core is IBM’s unified agent harness — a shared execution foundation introduced in the July 2026 architecture update. This harness provides:

• Native tool calling: Agents can invoke external tools (linters, test runners, build systems) as first-class operations, not prompt-injected workarounds.
• Parallel execution: Multiple sub-agents run concurrently — one agent generates tests while another refactors code while a third updates documentation.
• Sub-agent isolation: Specialized agents perform isolated work within their security context, preventing cross-contamination between tasks of different sensitivity levels.
• Background orchestration: Long-running tasks (full codebase analysis, migration planning) execute asynchronously while developers continue working.

Model Layer: Bring Your Own Inference

The model layer is where self-hosted deployment gets interesting. IBM decoupled model selection from the platform, so organizations choose their own inference stack:

Self-hosted models (running on customer GPUs):

• NVIDIA Nemotron — NVIDIA’s enterprise-optimized model family, designed for on-premises deployment with TensorRT optimization.
• Poolside Laguna — A code-specialized model built specifically for software development tasks, with strong performance on code generation and understanding.

Hybrid/private SaaS models (via approved external connectivity):

• Claude Sonnet 5.0 and Claude Opus 4.8 (Anthropic)
• Gemini 3.7 Flash (Google)
• OpenAI GPT 5.6 Sol

The BYOL (bring-your-own-license) approach means organizations negotiate model licenses directly with providers and deploy them on their own infrastructure — IBM doesn’t sit in the middle of that relationship.

BobShell: The Agentic CLI

BobShell is Bob’s command-line interface, and it’s designed with enterprise governance in mind from the ground up. Every agent action generates a structured, traceable audit trail in real time. For organizations subject to SOX, HIPAA, or FedRAMP, this isn’t a nice-to-have — it’s the difference between “we can use this” and “legal says no.”

BobShell supports three primary modes:

• Ask Mode: Analyze code without making changes — ideal for understanding unfamiliar codebases, reviewing PRs, or planning refactoring strategies.
• Plan Mode: Create technical architecture plans with dependency analysis and impact assessment before any code changes.
• Agent Mode: Full autonomous execution — Bob plans, codes, tests, and validates, with configurable approval checkpoints where developers review before changes commit.

Bobalytics: The Cost and Governance Dashboard

Introduced in July 2026, Bobalytics gives engineering leaders visibility into productivity, quality, governance, usage, and cost management. This is critical for self-hosted deployments where GPU costs are the organization’s responsibility. IBM claims Bob can reduce AI compute spend by approximately 40% through task-aware model routing — sending lightweight completions to smaller models rather than burning frontier-model tokens on boilerplate.

Premium Packages: Where RPA Meets Agentic Development

For readers of this site, the Premium Packages are where IBM Bob becomes directly relevant to the RPA and automation world. These packages target the exact legacy systems that RPA bots typically wrap — and they offer a path to modernize those systems rather than just automating around them.

Java Modernization Package

Handles the heavy lifting of JDK version upgrades (Java 8/11 → Java 17/21/25), Liberty modernization via IBM Application Modernization Accelerator, and legacy UI framework transformation (JSP, JSF, Struts → React/Angular). The package also generates unit tests and performs security remediation as part of the migration.

Real-world result: Blue Pearl completed a full Java uplift in approximately 3 days — 90% faster delivery, preserving 160+ engineering hours with zero post-deployment defects.

IBM i Package

This is the package that will resonate most with classic RPA teams. It introduces a Native Connection that lets Bob read source members directly from QSYS — no more export-import workflows to get RPG, COBOL, CL, or DDS source into the modernization pipeline. Capabilities include RPG modernization (fixed-form to free-form), DDS to DDL conversion, SQL optimization, and business-rule extraction.

For RPA architects who have spent years wrapping green-screen AS/400 applications with attended bots, this represents a fundamentally different approach: modernize the application itself rather than building an automation layer on top of it.

IBM Z Package

Built on the Z Understand static-analysis platform, this package processes COBOL, PL/I, assembler, and JCL. It includes Z Architect Mode (impact analysis, dependency assessment) and Z Code Mode (code explanation and transformation). APIS IT, a Croatian government IT provider, reported 10x faster documentation and multi-format architecture analysis with 100% accuracy in legacy system documentation.

Pricing: Bobcoins and Enterprise Tiers

IBM Bob uses a consumption-based model built around “Bobcoins” — resource units that measure AI task consumption. Here’s the current pricing structure:

Bobcoin consumption varies by task complexity:

• Simple tasks (code explanations, minor refactoring): 0.1–0.5 Bobcoins
• Program modernization (e.g., RPGLE conversion with tests): 2–5 Bobcoins
• Documentation generation: 1–3 Bobcoins
• Complex agentic workflows (CLI operations, multi-step agent mode): 5–10 Bobcoins
• Overage: approximately $0.50 per Bobcoin beyond the monthly allowance

Self-hosted deployments use the Enterprise tier with custom pricing. The BYOL model means GPU and model licensing costs are separate from the Bob platform fee — organizations that already run NVIDIA infrastructure can leverage existing capacity.

Promotional note: IBM is currently offering the first month free on Java Modernization and IBM i packages for new subscribers through December 31, 2026.

Real-World Results: What 80,000 Developers Tell Us

IBM’s internal deployment is arguably the largest single-organization coding agent rollout in the industry. Here are the numbers and case studies that matter:

The CrushBank result is particularly striking for automation architects: a single developer using Bob replaced what previously required a 4–6 person consulting team. That’s not a productivity improvement — it’s a staffing model transformation.

IBM Bob vs. the Enterprise Coding Agent Landscape

IBM isn’t competing in a vacuum. Here’s how Bob’s self-hosted offering stacks up against the major alternatives:

IBM’s GM of AI and Automation, Neel Sundaresan, frames the competitive positioning clearly: “What value you add on top of these models, how you orchestrate these models, how you maintain costs — that’s the question.” IBM isn’t trying to beat GitHub Copilot at inline completions. They’re targeting the governance, modernization, and sovereignty gap that SaaS-only tools can’t fill.

How to Evaluate IBM Bob Self-Hosted for Your Organization

If you’re an agentic AI architect evaluating self-hosted Bob, here’s a practical decision framework:

Step 1: Assess Your Sovereignty Requirements

Start with the regulatory question. If your organization is subject to any of the following, self-hosted Bob belongs on the shortlist:

• FedRAMP / ITAR / CMMC (U.S. government/defense)
• EU AI Act + GDPR data residency requirements
• PCI-DSS for financial systems
• HIPAA for healthcare codebases
• Any internal policy that prohibits source code leaving the corporate network

Step 2: Inventory Your GPU Infrastructure

Self-hosted inference requires GPU capacity. You’ll need to provision infrastructure for NVIDIA Nemotron or Poolside Laguna (or both). If you’re already running NVIDIA A100/H100 clusters for other AI workloads, Bob can share that capacity. If not, factor GPU procurement into the total cost of ownership.

Step 3: Map Your Legacy Estate

The Premium Packages (Java, IBM i, IBM Z) are where Bob delivers disproportionate value compared to general-purpose coding agents. If your organization runs significant COBOL, RPG, or legacy Java workloads — the exact systems that RPA bots are typically built to work around — Bob’s modernization capabilities may justify the investment on their own.

Step 4: Run a Controlled Pilot

IBM offers a 30-day free trial with 50 Bobcoins. Start with a low-risk internal project — a test suite generation task or a documentation-from-code exercise — before committing to Enterprise pricing. Measure Bobcoin consumption against actual productivity gains to build the business case.

What This Means for RPA and Automation Teams

IBM Bob’s self-hosted deployment creates a specific, practical opportunity for RPA teams and automation architects:

From wrapping legacy to modernizing legacy. The classic RPA play for AS/400, mainframe, and legacy Java applications has always been “screen-scrape the green screen, automate the human steps, don’t touch the underlying system.” Bob’s Premium Packages offer a different path: modernize the application itself so the RPA layer becomes unnecessary — or at minimum, thinner and less fragile.

This doesn’t mean RPA disappears. It means the role shifts. Instead of building bots that navigate legacy UIs, automation architects can use tools like Bob to extract business rules from COBOL, modernize the application to expose APIs, and then build agentic orchestration layers that connect to those APIs directly. The result is more reliable, more maintainable, and significantly cheaper to operate than a screen-scraping bot that breaks every time someone moves a field.

For organizations running UiPath Autopilot or Automation Anywhere’s agentic process automation, Bob isn’t a competitor — it’s a complementary tool. Use Bob to modernize the back-end systems, use your RPA platform to orchestrate the agentic workflows that connect to those modernized systems, and use enterprise agent governance to keep the whole stack auditable.

Security Considerations for Self-Hosted Deployment

Self-hosted doesn’t mean “set it and forget it.” Organizations managing their own Bob deployment take on responsibilities that IBM handles in the SaaS model:

• GPU provisioning and scaling: You own the inference infrastructure. Plan for peak loads during sprint cycles and release periods.
• Model updates: When Nemotron or Laguna ship new versions, you manage the upgrade cycle. Lag too far behind and you miss performance improvements; upgrade too fast without testing and you risk regressions in code quality.
• Monitoring and observability: Bobalytics gives you the application layer, but infrastructure monitoring (GPU utilization, memory pressure, network latency) is your responsibility.
• Regulatory audit trails: BobShell generates the data, but integrating it into your existing SIEM, GRC, and compliance reporting tools requires configuration work.
• CI/CD integration: Bob’s agent outputs need to flow into your existing build, test, and deployment pipelines. Plan for integration testing.

IBM’s own security posture includes prompt normalization (to prevent prompt injection), real-time sensitive data scanning (catching API keys and credentials before they hit version control), and AI red-teaming capabilities. These protections carry over to the self-hosted deployment — they’re part of the platform, not the SaaS wrapper.

The Bigger Picture: AI Sovereignty and the Enterprise Agent Stack

IBM Bob’s self-hosted launch fits into a broader trend that agentic AI architects need to track: the bifurcation of the enterprise AI market into cloud-native and sovereign tracks.

The cloud-native track — GitHub Copilot, Cursor, Replit Agent — optimizes for developer experience, speed, and instant access. These tools work brilliantly for startups, digital-native companies, and any organization comfortable with SaaS data processing.

The sovereign track — IBM Bob Self-Hosted, Amazon Q in private VPCs, and the emerging wave of on-premises agent platforms — optimizes for control, auditability, and data residency. These tools sacrifice some convenience for compliance guarantees that regulated industries require.

As NVIDIA’s Open Agent Safety Platform and the broader Agentic AI Foundation standards demonstrate, the industry is building the governance infrastructure that makes sovereign AI agent deployment practical. IBM Bob Self-Hosted is one of the first complete products to ship on that foundation.

The stock market agrees: IBM shares jumped 5% on the self-hosted announcement — a clear signal that Wall Street sees enterprise AI sovereignty as a category, not a feature.

FAQs

Can IBM Bob run completely air-gapped with no internet connection?

Yes. The self-hosted deployment supports fully air-gapped environments with no external connectivity. Inference runs on customer-provisioned GPUs using self-hosted models like NVIDIA Nemotron or Poolside Laguna. All code, context, and audit trails remain within the customer’s network perimeter.

What models does IBM Bob support for self-hosted inference?

At GA (October 2026), self-hosted inference supports NVIDIA Nemotron and Poolside Laguna. Hybrid deployments can additionally route to Claude Sonnet 5.0, Claude Opus 4.8, Gemini 3.7 Flash, and OpenAI GPT 5.6 Sol via approved external connectivity.

How does IBM Bob pricing work with Bobcoins?

Bobcoins are consumption units. Simple tasks (code explanations) cost 0.1–0.5 Bobcoins; complex agentic workflows cost 5–10 Bobcoins. Plans range from Pro ($20/month for 50 Bobcoins) to Ultra ($200/month for 1,000 Bobcoins). Self-hosted Enterprise pricing is custom. Overage runs approximately $0.50 per Bobcoin.

Does IBM Bob replace RPA tools like UiPath or Automation Anywhere?

No. Bob modernizes the legacy back-end systems that RPA bots typically automate around. In practice, Bob and RPA platforms are complementary: use Bob to modernize COBOL or RPG applications into API-accessible services, then use your RPA/agentic platform to orchestrate workflows against those modernized APIs. The result is a more reliable, less fragile automation layer.

What’s the difference between IBM Bob and IBM watsonx Code Assistant?

IBM Bob evolved from and supersedes watsonx Code Assistant. Bob adds multi-agent orchestration, multi-model routing, BobShell CLI, Bobalytics governance dashboard, and the self-hosted deployment option. The product page at ibm.com/products/ai-coding-agent redirects from the former watsonx Code Assistant URL, reflecting the rebrand.

Key Takeaways

• IBM Bob Self-Hosted shipped GA on October 1, 2026 — the first major enterprise coding agent platform to offer fully air-gapped, on-premises deployment.
• Three deployment patterns (air-gapped, private cloud, hybrid) let organizations match deployment to workload sensitivity, routing core banking code through on-prem inference while sending less-sensitive tasks to frontier models.
• Multi-model orchestration across NVIDIA Nemotron, Poolside Laguna, Claude, Gemini, and GPT models — with automatic routing based on task complexity and cost.
• 80,000+ IBM developers use Bob internally with a 45% average productivity gain. Customer results include 90% faster Java migration (Blue Pearl), 10x faster architecture analysis (APIS IT), and 4–6x team-size reduction (CrushBank).
• Premium Packages for Java, IBM i, and IBM Z directly address the legacy systems that RPA bots typically automate around — offering a “modernize instead of wrap” alternative.
• Bobcoin-based pricing runs from $20/month (Pro) to $200/month (Ultra), with custom Enterprise pricing for self-hosted deployments.
• For RPA/automation architects, Bob is complementary — not competitive — to platforms like UiPath and Automation Anywhere. Modernize the back end with Bob, orchestrate the agentic workflows with your RPA platform.

References

1. IBM. “IBM Bob expands to self-hosted environments for sensitive and mission-critical enterprise software.” IBM Announcements, October 1, 2026. ibm.com
2. IBM. “IBM Bob advances agentic software development with Premium Packages and a new enterprise AI foundation.” IBM Announcements, July 9, 2026. ibm.com
3. IBM Newsroom. “Introducing IBM Bob: AI Development Partner that Takes Enterprises from AI-Assisted Coding to Production-Ready Software.” April 28, 2026. newsroom.ibm.com
4. The New Stack. “IBM Bob hits 80,000 developers with 45% productivity gains.” 2026. thenewstack.io
5. DevOps.com. “IBM Moves Its Bob Coding Agent Inside the Firewall.” October 2026. devops.com
6. DevOps.com. “IBM Bob Gets Multi-Agent Muscle and a Cost Dashboard for Enterprise Coding.” 2026. devops.com
7. MarkTechPost. “IBM Brings Bob to Self-Hosted and Air-Gapped Environments.” October 2, 2026. marktechpost.com
8. 247 Wall St. “IBM Jumps 5% as Bob Coding Agent Gains Self-Hosted Deployment.” October 1, 2026. 247wallst.com
9. IBM. “AI coding agent and development partner for enterprises.” Product Page. ibm.com
10. Nick Litten. “IBM Bob Pricing Explained: Free Trial, Bobcoins and Pro Plans on IBM i.” 2026. nicklitten.com