Hermes Agent vs OpenClaw: Which Self-Hosted Agent to Run

Hermes Agent vs OpenClaw is the most common choice businesses face in 2026 when they want a self-hosted AI agent that lives in Slack, Telegram or WhatsApp and actually does work: runs commands, pulls reports, answers the team. Both are free, open source and model-agnostic. The difference is in what they are built around. Hermes Agent, from Nous Research, is built around one agent that learns your recurring work and gets better at it. OpenClaw is built around a gateway that routes many channels, accounts and agents for a whole team.

Most of the pages ranking for this comparison are published by hosting companies or integration vendors that sell one side or both. This guide is vendor-neutral. It gives you a decision rule, a feature table, real install and hardening commands for both, the security record from primary sources, a worked cost example, a migration path, and a checklist. Every number links to its source.

Hermes Agent vs OpenClaw: the short answer

If one person (a founder, an ops lead, a technical operator) wants a personal agent they will use for months, and the work repeats often enough for saved skills to pay off, pick Hermes Agent. It is easier to lock down by default, its learning loop is the most developed of any open agent harness, and its scheduler is built for unattended jobs.

If several people need to share one agent system across many channels and accounts, with separate personas for sales, support and operations, pick OpenClaw. Its multi-agent routing and channel bindings are more mature, its ecosystem is larger, and it is built as shared infrastructure rather than a personal assistant.

If nobody on your team is comfortable in a terminal, or the agent would touch customer data with no one watching it, pick neither yet. Both tools can run shell commands on the machine they live on. That is the source of their power and of their risk. A managed workflow tool with an AI step, such as n8n or Make, is the safer first move in that case, and we cover those alternatives below.

The rest of this guide explains why, so you can check the reasoning against your own situation rather than take the verdict on trust. If you want background on either tool first, our explainer on what Hermes Agent is covers its learning loop in detail.

What each one is: two different centres of gravity

Both projects are agent harnesses, not models. You bring a language model from Anthropic, OpenAI, OpenRouter or a local server, and the harness supplies everything around it: a chat interface, tools that run commands and edit files, memory, a scheduler and connectors to messaging apps. Both are MIT-licensed on GitHub (Hermes Agent, OpenClaw), so there is no licence fee and commercial use is allowed.

Hermes Agent: one agent that grows with you

Hermes is a Python application whose tagline is “The agent that grows with you.” Its core idea is persistence. Two small Markdown files hold curated memory about the agent’s work and about you; the memory documentation caps them at 2,200 and 1,375 characters so they stay cheap to load on every turn. Every past conversation is stored in SQLite with full-text search, so the agent can look up old details on demand. After a complex task, it writes a reusable skill and refines it next time. The CLI, the messaging gateway, the memory and the scheduler all share one core loop.

OpenClaw: a gateway for many channels and agents

OpenClaw is a Node.js application whose centre is the Gateway: a long-running process that connects chat channels, pairs devices, routes messages to agents and enforces access rules. The repository lists Discord, iMessage, Slack, Teams, Telegram, WhatsApp and 20+ other channels, plus companion apps for macOS, iOS, Android, Windows and Linux. Its multi-agent routing lets one Gateway run several isolated agents, each with its own workspace, credentials and session history, and map each WhatsApp number or Slack workspace to the right one.

The practical consequence: Hermes optimises for depth with one owner, OpenClaw optimises for breadth across people and channels. Both have borrowed from each other in 2026, so the gap is narrower than older comparisons suggest, but the centres of gravity have not moved. This is the same trade-off we describe in single agent vs multi-agent architecture.

Side-by-side comparison table

The table below uses each project’s own repository and documentation as the source, checked in late October 2026. Star counts move weekly, so treat them as an indication of community size, not quality.

Sources for the rows: the two repositories above, the Hermes security guide, the OpenClaw sandboxing guide, and each project’s GitHub security advisories page. The advisory counts need context, which we give in the security section.

Who should pick Hermes, who should pick OpenClaw, and who should pick neither

Feature tables do not make decisions; situations do. Here is how we map common small and mid-sized business situations to the two tools, and the reason behind each call.

Pick Hermes Agent when

• One owner, recurring work. A founder who wants “summarise yesterday’s support tickets” and “check last night’s invoice run” from Telegram every morning. The skill loop rewards repetition: the tenth run is cheaper and more reliable than the first because the agent loads a saved procedure instead of rediscovering it.
• Unattended scheduled jobs. Hermes treats headless runs as a separate risk class. Its security guide sets cron_mode and unattended_mode to deny dangerous commands by default, which is exactly what you want at 3 a.m. with nobody watching.
• You want safety without much configuration. The default approval mode asks a second model to assess each risky command, and a hardline blocklist refuses commands like rm -rf / even in YOLO mode.

Pick OpenClaw when

• Several people, several channels. A support WhatsApp number, a sales Slack workspace and an internal Teams channel, each mapped to its own agent with its own credentials and workspace.
• You need the widest integration list. The bigger community means more channels, more companion apps and more ready-made plugins.
• You have someone who will own hardening. OpenClaw can be locked down well, but more of that is your job: sandboxing is opt-in, and the docs assume one trust boundary per Gateway.

Pick neither (yet) when

• No one on the team can read a config file or a shell command and tell whether it is safe.
• The agent would answer customers directly with no approval step. Start with a human review gate, as described in our guide to human-in-the-loop agentic AI.
• Your data rules forbid sending content to an outside model provider and you have no budget for a local model. Self-hosting the harness does not keep data in-house if the model call goes to a cloud API.

Install and first run: step by step for both

Run either tool on a dedicated machine or a small VPS, not on a laptop that holds your password manager and client files. Both can execute shell commands as the user they run under, so the machine is the blast radius. Create a separate, non-admin OS user for the agent before you start.

Hermes Agent

The Hermes repository gives a one-line installer for Linux, macOS and WSL2 that also installs Python, Node.js, ripgrep and FFmpeg:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
source ~/.bashrc        # or ~/.zshrc
hermes                  # first run starts setup
hermes model            # pick or switch the model provider
hermes gateway          # start the messaging gateway

Before connecting a chat app, restrict who can talk to the agent. The security guide checks allowlists such as TELEGRAM_ALLOWED_USERS and GATEWAY_ALLOWED_USERS and denies everyone else by default. Unknown DMs can get a one-time pairing code that you approve with hermes pairing approve <platform> <code>. If the agent will run commands, switch the terminal backend to Docker in ~/.hermes/config.yaml (terminal.backend); Hermes then drops all Linux capabilities and limits the container to 256 processes.

OpenClaw

The OpenClaw repository offers a script installer that also sets up a supported Node runtime, or an npm install if you manage Node yourself:

curl -fsSL https://openclaw.ai/install.sh | bash
# or, with Node already installed (npm 11.16+):
npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon
openclaw gateway status
openclaw dashboard

Then turn on sandboxing, because it is off by default. The sandboxing guide gives this minimal config, which sandboxes every session except the main one and hides the workspace from the sandbox:

{
  agents: {
    defaults: {
      sandbox: {
        mode: "non-main",
        scope: "session",
        workspaceAccess: "none",
      },
    },
  },
}

Finish with openclaw security audit, which the security docs describe as the check for drift from safe defaults. Fix findings in the order the audit lists them. Approve new chat contacts with openclaw pairing approve <channel> <code> rather than switching DM policy to open.

Security: the track record and how to harden each one

Security is where the two tools differ most, and where vendor comparisons are least reliable, so here are the primary sources.

OpenClaw’s record

OpenClaw’s GitHub security advisories page runs to more than 70 pages of published advisories, most rated moderate, with some high and critical. One example: CVE-2026-32922, rated 9.4 (critical) under CVSS 4.0, let a caller with pairing scope mint admin tokens for paired devices, which could lead to remote code execution on connected nodes; it was fixed in version 2026.3.11. The skills marketplace has also been attacked. In February 2026, The Hacker News reported that Koi Security found 341 malicious skills among 2,857 reviewed on ClawHub, 335 of them part of a campaign named ClawHavoc that installed the Atomic macOS stealer through fake prerequisite steps.

Hermes Agent’s record

The Hermes repository lists no published security advisories at the time of writing. Read that carefully. It is a younger project with a smaller attack surface (fewer channels, no central marketplace on the scale of ClawHub) and less outside scrutiny. “No advisories” is evidence of a safer default design, not proof that the code has no holes. Its documented defaults are stronger: approval checks on dangerous commands, deny-by-default for headless runs, a protected-path list that blocks writes to ~/.ssh/, and environment filtering so child processes do not inherit your API keys.

Hardening steps that apply to both

1. Isolate the host. Separate OS user, separate machine or VPS, no personal files. Both docs treat the user account as the real boundary.
2. Allowlist every human. Use pairing or explicit allowlists. Never set DM policy to open on a business number.
3. Sandbox command execution. Docker backend on Hermes, agents.defaults.sandbox on OpenClaw.
4. Treat skills like software dependencies. Read a skill before installing it. The ClawHavoc skills worked by asking the user to run a “prerequisite” command.
5. Update on a schedule. Most OpenClaw CVEs were fixed quickly; the risk sits with installs that never update.
6. Keep the gateway off the public internet. OpenClaw binds to loopback on a normal host install, but its docs warn that container images default to an exposed bind.

For the wider risk picture when an outside party runs automation for you, see the security risks of outsourcing automation.

Multi-agent teams, channels and scheduling

This is where OpenClaw earns its place. Its multi-agent documentation defines an agent as a full persona scope (workspace, credentials, model settings, session store) and a binding as a rule that maps a channel account to an agent. A business with a personal and a business WhatsApp number can route each to a separate agent:

{
  agents: {
    entries: {
      home: { workspace: "~/.openclaw/workspace-home" },
      work: { workspace: "~/.openclaw/workspace-work" },
    },
  },
  bindings: [
    { agentId: "home", match: { channel: "whatsapp", accountId: "personal" } },
    { agentId: "work", match: { channel: "whatsapp", accountId: "biz" } },
  ],
}

Agents are created with openclaw agents add work, checked with openclaw agents list --bindings, and a preset coordinator, researcher, writer and reviewer team comes from openclaw agents team create. The docs warn never to reuse an agent directory across agents, because auth and session state collide. Note also that cross-agent session access (tools.agentToAgent) is on by default; turn it off if your sales and finance agents should not read each other’s conversations.

Hermes is stronger on scheduling. Its cron documentation accepts plain-English schedules and delivers results to any connected channel:

hermes cron create "weekdays at 9am" "Summarise new support tickets and flag anything urgent" --deliver slack
hermes cron create "every 1h" "Post the digest" --paused --paused-reason "Awaiting review"
hermes cron runs <job_id> --limit 20

The --paused flag is a useful habit: create the job, run it once by hand with hermes cron run, read the output, then resume. OpenClaw has an equivalent in openclaw cron, but its documented examples focus on one-shot reminders and system events. If routing many people to many agents is the core need, choose OpenClaw. If scheduled, unattended jobs are the core need, choose Hermes. For how to coordinate several agents once you have them, see orchestrating AI agents for business.

Costs and limits, with a worked example

Neither harness costs anything to download. You pay for three things: the machine it runs on, the model tokens, and the hours someone spends maintaining it. The harness choice changes the first and third far more than the second.

Hosting

The Hermes README says it runs on anything from “a $5 VPS” to a GPU cluster, and its Modal and Daytona backends hibernate when idle. Nous also sells hosted options. Composio’s 2026 comparison lists Hermes Cloud at $0.29 to $1.09 per day while running and Nous Portal plans at $20 to $200 per month; those figures come from a vendor write-up, so confirm them with Nous before budgeting. OpenClaw needs the same small always-on machine for the Gateway, plus more if you run sandboxes or many agents.

Tokens: a worked example

Assume an ops agent handles 40 requests a day. Each request sends about 20,000 input tokens (system prompt, memory, skill text, tool output) and returns about 1,500 output tokens. That is 800,000 input and 60,000 output tokens per day. These volumes are our assumption for a moderately busy internal assistant, not a measured benchmark.

At Anthropic’s published prices of $2 per million input tokens and $10 per million output tokens for Claude Sonnet 5.5, that is $1.60 plus $0.60, or $2.20 a day: about $66 for a 30-day month. On Claude Haiku 5.5, priced at $0.10 and $0.50 per million for prompts under 100,000 tokens, the same load costs $0.08 plus $0.03, or $0.11 a day: about $3.30 a month. Prompt caching lowers both figures further, because the system prompt and memory repeat on every turn.

The lesson: model choice moves the bill twentyfold, the harness barely moves it. What the harness does change is prompt size. Hermes keeps its always-loaded memory deliberately small; OpenClaw’s per-agent workspace files (AGENTS.md, SOUL.md, USER.md) are loaded per agent, so ten agents with long persona files cost more per turn than one. Our guide to the cost of running multi-agent systems goes deeper.

Limits to plan for

• Hermes’ curated memory is small by design. Long reference material belongs in files or skills, not in memory.
• OpenClaw’s trust model assumes one trust boundary per Gateway. Mixed-trust users (staff plus customers) need separate Gateways, ideally on separate OS users or hosts.
• Both move fast. Composio recorded OpenClaw v2026.9.4 and Hermes v0.21.2 released on the same day in September; budget an hour a month for updates and reading changelogs.

Migrating between them

Switching is easier in one direction than the other. Hermes ships an importer for OpenClaw. The migration guide gives these commands:

hermes plugins install agent-importers
hermes import-agent openclaw --dry-run      # preview only
hermes import-agent openclaw --preset full --migrate-secrets --yes

It brings over persona and memory files (SOUL.md, MEMORY.md, USER.md), skills, model and provider settings, MCP servers, and Telegram, Discord, Slack, Signal, Matrix and Mattermost tokens and allowlists. API keys move only when you pass --migrate-secrets, and only from an allowlist of known provider keys. Several things do not migrate: cron jobs, plugins, hooks, multi-agent lists and channel bindings are archived for manual review, and WhatsApp must be re-paired by QR code. Hermes also takes a backup zip before it changes anything.

Going from Hermes to OpenClaw, we found no documented importer. Skills follow the shared Agent Skills format, so they can be copied by hand, but memory, schedules and channel settings must be rebuilt. If you are undecided, that asymmetry is a small argument for starting with OpenClaw when team routing might matter later, and for starting with Hermes when it clearly will not.

Whichever direction you go, run both side by side for a week on a test channel before switching your real numbers over. The migration report lists what it skipped; read it.

Common mistakes and how to avoid them

1. Running the agent on your main laptop. Both tools run commands as your user. One prompt injection in a web page or email the agent reads can reach every file you can. Use a separate machine or OS user.
2. Leaving OpenClaw sandboxing off. It is off by default and main-session tools run on the host. Turn on agents.defaults.sandbox on day one, not after an incident.
3. Turning on YOLO mode in Hermes to stop the prompts. Use hermes approvals suggest --apply instead; it proposes permanent allowlist entries from your approval history and never proposes destructive commands.
4. Installing marketplace skills without reading them. ClawHavoc proved that skills are a supply chain. Read the SKILL.md and any script it calls before installing.
5. Opening DMs to anyone. A business WhatsApp number with an open DM policy is an open shell. Keep pairing or allowlists on.
6. Choosing the expensive model for every task. Per the worked example, a small model for routine summaries costs a fraction of a frontier model. Reserve the large model for tasks that need reasoning.
7. Never updating. Most published OpenClaw vulnerabilities have fixed versions. An install that is six months old is carrying all of them.

Many of these mistakes have the same root: treating the agent like a chat app instead of like a new employee with shell access. Give it the access a new hire would get on day one, and widen it as it earns trust.

A worked scenario: a 12-person agency

To make the decision concrete, here is how we would set up a typical client: a 12-person marketing agency with a founder, two account managers, a client WhatsApp line and an internal Slack. This is an illustrative configuration, not a measured case study.

What they want: the founder wants a morning digest of overdue tasks, invoices and campaign anomalies. The account managers want an assistant in Slack that drafts client updates from the project tracker. The client WhatsApp line should get quick, approved answers about report schedules.

What we would run: Hermes for the founder, on a small VPS with the Docker backend, allowlisted to the founder’s Telegram ID, with three cron jobs created paused and resumed after one manual run each. Repeating the same digest every morning is exactly the pattern its skill loop is built for. For the team and client channels, a single OpenClaw Gateway on a separate host with two agents (internal and client), each bound to its own channel account, sandboxing on, cross-agent access off, and every outbound client message held for human approval.

Why not one tool: the founder’s agent holds the most sensitive access (finance, email) and benefits most from learning; the team setup needs routing and separation. Two small machines cost less than one breach. If budget allows only one, start with OpenClaw for the shared channels, because that is where more people are affected, and add Hermes later.

Alternatives and when to use them

Hermes Agent and OpenClaw are not the only way to put an AI agent to work. Consider these first when the shoe fits:

• A workflow tool with an AI step (n8n, Make, Zapier). When the job is a fixed sequence (new form, enrich, write to CRM, notify), a visual workflow is more predictable, easier to audit, and needs no shell access. Agents add value when the steps are not known in advance.
• A coding agent CLI (Claude Code, Codex). When the work is mostly code and repositories, a vendor CLI with strong permission controls is the more direct fit. We compare the two in Claude Code vs Codex.
• An agent framework (LangGraph, CrewAI, the Claude Agent SDK). When you are building a product feature rather than an internal assistant, a framework gives you control over every step and fits into your own codebase.
• Hosted agents from the projects themselves. Hermes Cloud and managed OpenClaw hosts remove server upkeep, at the cost of putting your agent’s credentials on someone else’s infrastructure.

A useful test: if you can draw the process as a flowchart with fewer than ten boxes, start with a workflow tool. If you cannot, because the steps depend on what the agent finds, an agent harness earns its complexity.

Decision and launch checklist

Use this list before you commit. If you cannot tick the first section, revisit the “pick neither” advice above.

Decide

• Is there one owner (Hermes) or several users and channels (OpenClaw)?
• Does the work repeat weekly or more often, so saved skills pay off?
• Will jobs run unattended? Favour Hermes’ deny-by-default headless mode.
• Who on the team will own updates and security review, by name?
• Which model provider and which data may it see?

Launch

• Dedicated machine or VPS, separate non-admin OS user.
• Allowlists or pairing on every channel; DM policy never open.
• Sandboxed command execution (Docker backend or agents.defaults.sandbox).
• Security audit run (openclaw security audit) or approval mode reviewed (approvals.mode in Hermes).
• Scheduled jobs created paused, run once by hand, then resumed.
• Cheap model for routine work, larger model only where needed.
• Monthly update and changelog review on the calendar.
• Human approval on anything a customer will see.

FAQ

Can I run Hermes Agent and OpenClaw together?

Yes, and some teams do: OpenClaw handles shared channels and routing, while Hermes runs as a personal agent for one owner. Keep them on separate OS users or machines so each has its own credentials, and do not let them share a workspace directory.

Which one is easier for a non-developer?

Both install with one command, and both need someone who can read a config file. OpenClaw’s onboarding wizard and dashboard are friendlier for channel setup, while Hermes needs less security configuration to be safe. If no one on the team is comfortable in a terminal, use a managed host or a workflow tool instead.

Do I need a GPU or a local model?

No. Both call cloud model APIs by default, so a small CPU-only VPS is enough. A local model through a server like Ollama is an option if data must stay in-house, but then you need hardware strong enough to run it.

Does Hermes Agent really improve over time?

It improves its procedures, not its model. It saves skills after complex tasks, patches them when it finds a better way, and keeps short notes about you. The underlying language model’s weights do not change, so quality is still capped by the model you choose.

Is OpenClaw safe to use after all those CVEs?

It can be, if you keep it updated and harden it. The published vulnerabilities have fixed versions, and the project runs a public advisory process. The risk is concentrated in old installs, open DM policies, unsandboxed hosts and unreviewed marketplace skills.

Can Hermes use my OpenClaw skills?

Yes. Both use the Agent Skills format, and the Hermes importer copies OpenClaw skills into a separate imports folder, skipping name conflicts by default. Review each imported skill once, since the two tools expose different tool names.