OpenClaw vs. Hermes: Why Open-Source AI Agents Are Hard Work

I have to open with a correction, because the first cut of this piece got the framing backwards. It called Hermes Agent the “managed” option and OpenClaw the raw engine. That is not what either project is. Both are MIT-licensed, both are self-hosted, both put the credentials on YOUR box.

So I went back and read the docs like an SRE. Install scripts, sandbox pages, the security guides, the pricing page. What follows is what those pages actually say, not what the hype says.

What OpenClaw actually is

OpenClaw is a self-hosted gateway that plugs AI coding agents into the chat apps you already live in. Discord, Slack, Telegram, WhatsApp, Signal, iMessage, Teams, the whole list. You run the Gateway on your own machine or server and it becomes the control plane for sessions, tools, and channel connections.

The maintainer story matters here. Creator Peter Steinberger joined OpenAI in February 2026, and the project moved into the OpenClaw Foundation, an independent 501(c)(3). The repo sits at 389,116 stars as of September 7, 2026, and OpenClaw 2.0 (v2026.8.1) shipped on August 31 with shared cloud sessions and a rebuilt browser app. Per its own docs, there is no paid tier and no hosted service in the middle.

That is the appeal and the tax in one sentence. Nobody is selling you a seat. Nobody is running it for you either.

What Hermes Agent actually is

Hermes Agent is Nous Research’s open-source agent. Its pitch is a built-in learning loop: it writes skills from experience, improves them during use, and keeps memory across sessions. It runs in the terminal, as a desktop app, and behind the same messaging gateway pattern (Telegram, Discord, Slack, WhatsApp, Signal, email).

The install is a one-liner, same as OpenClaw. The difference is where the shell commands land. Hermes ships seven terminal backends: local, Docker, SSH, Singularity, Modal, Daytona, and Vercel Sandbox. You pick where the agent’s hands go. The repo is at 242,975 stars as of the same date, so this is not a side project.

Model-wise it is provider-agnostic. Nous Portal, OpenRouter, OpenAI, or your own endpoint. No lock-in on either side of this comparison, which is why the best AI agents in 2026 list keeps both of them off the SaaS column.

Install and deploy: both self-host, only one has a hosted exit

Both projects install with a curl-pipe-bash script. Both run on a cheap VPS. Both expect you to bring an API key or a subscription for the model.

The fork in the road is what happens when you get tired of babysitting. OpenClaw’s answer is “run it yourself, forever.” Hermes has Hermes Cloud, an always-on hosted agent that is in preview, needs $10 in credits or an active subscription to deploy, and scales to zero when idle. That is the closest thing to a managed lane in this matchup, and it belongs to Hermes, not OpenClaw.

OpenClaw vs Hermes Agent vs WorkBuddy vs DeepSeek Harness

The permissions problem: who protects your keys

Here is the part that gets people hurt. In a managed product, the vendor eats the security bill. In both of these, you are the security team. The two projects just start you from very different defaults.

OpenClaw’s own sandboxing page says sandboxing is off by default, controlled by agents.defaults.sandbox. Even when you turn it on, the Gateway process stays on the host and only tool execution moves into Docker, Podman, SSH, or its OpenShell backend. The docs’ own words: “not a perfect security boundary.” The security page in the same docs is blunt that OpenClaw is not a hostile multi-tenant boundary, and it ships an openclaw security audit command so you can check your own config. Everything under ~/.openclaw/ should be treated as a secret. The GitHub security advisories page for the repo lists 647 published advisories as of this writing. That is not a knock on the team. That is what a 389,000-star codebase with shell access looks like when people actually audit it.

Hermes goes the other direction. Its security docs describe command approval that is ON by default: a curated dangerous-pattern list (rm -r, chmod 777, mkfs, curl | sh, SQL DROP) plus a “smart” mode that uses an auxiliary model to auto-approve low-risk commands and escalate the uncertain ones. When Hermes spawns a subprocess, it strips environment variables whose names contain KEY, TOKEN, SECRET, PASSWORD, CREDENTIAL, PASSWD, or AUTH. The Docker backend runs with cap-drop ALL, no-new-privileges, and a 256 PID limit. Unknown DM senders get an 8-character pairing code with a one-hour TTL, and if no allowlist is configured, everyone is denied.

Hermes is honest about its own gap too. Write guards cover write_file and patch only; the terminal tool runs as your OS user and can still overwrite denied paths through the shell. Container isolation is opt-in. So it is safer out of the box, not safe.

If you do not know what an AI agent is at the mechanical level (a loop that runs code with your credentials), do not run either of these on a box that holds keys you care about. Run them on a burner VPS first.

What it costs

OpenClaw: $0 for the software, plus whatever your model provider charges. No subscription exists to buy.

Hermes: $0 for the software. If you want the bundled path, Nous Portal runs Free ($0, free models only), Plus ($20/mo with $22 in monthly credits), Super ($100/mo with $110 in credits), and Ultra ($200/mo with $220 in credits), with $10 to $200 top-ups. Paid tiers include the hosted tool gateway and credits usable in Hermes Cloud.

Neither cost line includes your time. That is the real bill in this category.

Who should pick which

Solo builder or two-person shop with no ops background: Hermes Agent. The approval layer and the env-var stripping catch the mistakes you do not know you are making yet.

Team with a real SRE who wants the agent in every chat surface the company uses: OpenClaw. The channel coverage is unmatched, and 2.0’s shared cloud sessions are built for exactly that. Turn sandboxing on, bind the Gateway to loopback, run the audit command, and put it in your change-management flow like any other production AI stack component.

Company that will never self-host anything: neither, honestly. Buy a seat somewhere and stop reading GitHub advisories on Sunday.

OpenClaw is the truth for the builders who need every channel and total sovereignty. Hermes is the truth for the builders who want the same sovereignty with guardrails already bolted on. Pick the one whose defaults match the person who will be on call.

#TheAIMogul