Hermes Agent vs OpenClaw: Which One Should You Run in 2026

---

What Is OpenClaw

OpenClaw is an open-source, self-hosted personal AI assistant that runs as a background process called the Gateway. It connects to the messaging platforms you already use, remembers context across sessions once you configure it to, and can run shell commands, browse the web, manage files, and act on a schedule. The Gateway itself is the control plane, not the reasoning, which shapes how the whole system executes and coordinates work as much as the model behind it does.

The project has changed names twice. It launched in November 2025 as Clawdbot, became Moltbot after a trademark dispute, and settled on OpenClaw days later. In February 2026, creator Peter Steinberger announced he was joining OpenAI, and stewardship of the project passed to the independent, non-profit OpenClaw Foundation.

Quick facts

• Install with curl -fsSL https://openclaw.ai/install.sh | bash on macOS and Linux, a PowerShell one-liner on Windows, or npm install -g openclaw@latest
• Runs on macOS, Linux, and Windows, needs Node 24.15 or newer, with companion apps for Windows, macOS, iOS, and Android
• 384,000+ GitHub stars and forks well past 78,000 as of late July 2026, MIT licensed
• Connects through 25+ bundled channel plugins, including WhatsApp, Telegram, Slack, Discord, Signal, iMessage, and Microsoft Teams
• Bring your own model through Anthropic, OpenAI, Google, xAI, OpenRouter, GitHub Copilot, or MiniMax, or sign in with a Claude Pro/Max, ChatGPT/Codex, or GitHub Copilot subscription instead of an API key

Hermes Agent takes a different approach to nearly every one of those points.

---

What Is Hermes Agent

Hermes Agent is Nous Research’s open-source, self-hosted AI agent, built around what the team calls a closed learning loop. Rather than treating every conversation as a blank slate, Hermes writes what it learns into persistent memory and reusable skills, then carries both forward into the next session without you asking it to.

Nous Research is the lab behind the Hermes family of open models, and the agent shares the name. It launched publicly in February 2026 and has kept a fast release cadence since, including a native desktop app in June and an August release that closed dozens of long-standing priority-one issues in the repository at once.

Quick facts

• Install with curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash on Linux, macOS, WSL2, and Termux, or a native PowerShell installer on Windows
• Runs on macOS, Linux, and Windows, plus a native desktop app with drag-and-drop file chat and concurrent multi-profile sessions
• 215,000+ GitHub stars and roughly 40,000 forks as of late July 2026, MIT licensed, built by Nous Research
• Reaches you across 20+ platforms from a single gateway, including Telegram, Discord, Slack, WhatsApp, Signal, and email
• Works with any model provider you bring, or route everything through the optional Nous Portal subscription for access to 300+ models and a bundled tool gateway

---

Memory Management: Hermes Agent vs OpenClaw

This is the actual architectural split between them, and it explains most of the other differences on this page.

OpenClaw’s Memory System

OpenClaw treats memory as something the agent has to go get, not something handed to it automatically.

• It only pulls prior context into a session when the agent explicitly calls a memory search tool
• Nothing is injected by default at session start
• Workspace context lives in plain files, an AGENTS.md and a SOUL.md in the agent’s workspace root, that you can open and edit with any text editor
• Skills are markdown files that a person, or the agent acting on instruction, writes once. Nothing about them changes on its own afterward

Hermes Agent’s Persistent Memory

Hermes runs the opposite default. It hands the agent a memory snapshot before you’ve asked for anything.

• Every new session opens with a frozen snapshot of relevant memory already sitting in the system prompt, no retrieval step required
• That snapshot is backed by a SQLite store with full-text search and periodic self-curated memory nudges
• An optional Honcho memory-provider plugin, when installed, builds a running picture of who you are and how you work across sessions, rather than just logging isolated facts
• After a task, the agent can synthesize the interaction into a new skill on its own, and that skill keeps refining itself the more it gets used. This self-improvement loop is one capability OpenClaw structurally does not have

Neither model is wrong. One asks before it remembers. The other remembers so it never has to ask. Which one you want depends entirely on how much you trust an agent’s own judgment about what belongs in its long-term memory, which is exactly the question the next section tests.

---

Security Comparison: OpenClaw vs Hermes Agent

Both agents grant real machine access. Shell commands, file operations, browser control, sometimes email. Neither vendor pretends otherwise, and the failure modes below are documented, not theoretical.

OpenClaw Security

The ClawBleed token exfiltration bug

• Its most serious disclosed flaw is CVE-2026-25253, nicknamed ClawBleed, a CVSS 8.8 one-click remote code execution bug
• A crafted link could exfiltrate a user’s gateway auth token through an unvalidated WebSocket parameter, bypassing the localhost protection most users assumed kept them safe. It’s the kind of long-lived credential theft that’s pushed parts of the industry toward short-lived, federated identity in place of static API keys
• It was patched within days of disclosure, in version 2026.1.29
• Since then, defaults have tightened. Unknown senders on DM-capable channels now receive a pairing code instead of being processed automatically, and non-main sessions can be routed into Docker or SSH sandboxes, a layered-permission approach that lines up with NSA and CISA’s current hardening guidance for MCP deployments

The ClawHub skill marketplace problem

• OpenClaw’s skill marketplace, ClawHub, has its own separate track record. A wave of malicious third-party skills was caught stealing credentials before removal, one reason some teams now reach for tighter, more sandboxed OpenClaw alternatives instead of trusting the marketplace by default.

Broad access plus a large, loosely vetted marketplace, sitting alongside a single flaw rated near the top of the CVSS scale, is the shape of OpenClaw’s risk.

Hermes Agent Security

Hermes Agent’s risk shows up somewhere else entirely, and it is worse in a specific, measured way. A 2026 security benchmark study, built specifically to test memory poisoning across both agents, planted adversarial content in something the agent reads normally, a webpage, a document, a tool output, and measured how often the agent went on to write that content into its own persistent memory.

Once a malicious entry was actually written, it went on to influence a later session 64.70% of the time on Hermes against 17.40% on OpenClaw.

Why the numbers land this way

• Hermes writes to memory more freely under a more permissive retention policy
• Its compaction threshold sits at a comparatively short 2,200 characters, which is easier for an attacker to trigger on purpose
• Because memory gets frozen into the system prompt automatically, a poisoned entry reaches the agent without needing a retrieval step an attacker would otherwise have to trigger

Hermes has accumulated its own separate set of disclosed CVEs, covering a memory-content-scanning injection bug, a session-resume authorization bypass, and a platform-adapter authentication issue among others. None of them has been confirmed at the severity of OpenClaw’s two highest-rated flaws, but “no severe CVE yet” is a different claim from “no CVE,” and it’s worth tracking both projects’ advisories rather than assuming either one has a clean record.

Neither agent is the safe one. They trade different attack surfaces for different capabilities. OpenClaw’s exposure comes from breadth, a large marketplace and a broad permission model, plus one flaw that outranks anything Hermes has disclosed so far. Hermes Agent’s comes from depth, a memory system built to be genuinely useful specifically because it writes and trusts more than a conservative one would.

Security profile aside, the differences that shape daily use are more mundane, and mostly come down to reach

---

Feature Comparison: Skills, Channels, and AI Models

Reach comes down to three things, which channels each one covers, how skills move between them, and which models each expects you to bring.

Moving Skills Between Both Agents

The skill format gap looks bigger in the table above than it actually is day to day. Hermes adopted the open agentskills.io standard, designed specifically so skills can move between agent platforms rather than staying locked to one marketplace, and a community-built bridge called HermesClaw already lets both agents run against the same WeChat account. Whether OpenClaw’s own skill runtime reads agentskills.io-format files directly isn’t confirmed, but the standard itself is built for that kind of portability. If OpenClaw’s own skill system is what’s keeping you on it, that lock-in is weaker than it used to be.

Model Support and Default Routing

Model support looks similar on paper. Both are provider-agnostic, and both work with local models through Ollama. The practical difference is default routing.

• OpenClaw leans on subscription sign-in for Anthropic, OpenAI, and GitHub Copilot accounts you likely already have
• Hermes leans on its own Nous Portal as the path of least resistance

Neither default is mandatory. Nothing stops you from pointing either agent at whichever model actually fits your workload instead. None of that routing is free, though, and what each one actually costs varies more than the marketing implies.

---

Pricing and Running Costs

The software is free either way. For both agents, the real bill comes from where you host the process and which model answers each request.

OpenClaw’s Cost Path

April’s block, and a fix that never fully landed

OpenClaw’s cost story got more complicated this year through no fault of its own.

• On April 4, 2026, Anthropic blocked Claude Pro and Max subscription tokens from powering third-party agent frameworks, OpenClaw included, citing capacity strain from usage patterns subscriptions weren’t designed for
• Users who had been running heavy agent workloads through a flat $20 to $200 monthly plan were pushed onto metered API billing overnight, with some reporting cost increases as high as 50x
• Anthropic restored subscription access around May 13, 2026, and announced a separate Agent SDK credit system to launch June 15, splitting Agent SDK and third-party usage onto its own monthly allowance instead of the shared subscription pool
• On June 15, the day that credit system was due to go live, Anthropic paused it before it took effect. Per Anthropic’s own help center, nothing changed. Agent SDK and third-party usage still draw from normal subscription limits, and there’s no credit to claim
• Anthropic says a revised plan is coming but hasn’t set a date, so treat OpenClaw’s subscription economics as unsettled rather than resolved

Hermes Agent’s Cost Path

Hermes ties its cost to the same two levers, hosting and model choice, without a comparable subscription history to navigate.

Running it lean

• A minimum viable VPS from Hetzner, DigitalOcean, or Linode runs $5 to $7 a month
• A budget model like DeepSeek V4 keeps a typical personal-assistant workload in the low single digits monthly
• OpenRouter, direct provider keys, and local Ollama models all work without any subscription at all

Or paying for the bundle

The optional Nous Portal subscription, launched April 27, 2026, bundles 300+ models plus a Tool Gateway covering web search through Firecrawl, image generation, text-to-speech, and browser automation behind one bill. None of it is required.

For either agent, the model you pick swings the bill far more than the runtime does. A rough sense of what different model tiers actually cost at agent-scale usage is worth checking before assuming either tool is expensive by default.

---

OpenClaw vs Hermes Agent: Side-by-Side Comparison

Every figure below traces back to the sections above it. The table holds data, not a verdict.

None of this adds up to a single winner. It adds up to five different situations, matched below.

---

Which Agent Should You Actually Run

Here’s how that breaks down.

• Staying on OpenClaw: It’s already running on Telegram, Discord, or Slack, and it works. The security research changes the shape of the risk you’re managing. It doesn’t change whether OpenClaw is usable.
• Migrating from OpenClaw to Hermes: This is the strongest reason to switch. hermes claw migrate imports memories, skills, command allowlists, and API keys in one pass, with a dry-run flag to preview what moves first.
• Wanting memory that improves on its own: That is what Hermes is built for. Weigh it against the memory poisoning numbers above if the agent will ever read content you don’t fully trust, a public inbox, scraped web pages, or shared documents.
• Needing the widest reach today: OpenClaw still leads on channel count and skill marketplace size, and its non-profit foundation backing gives it a longer institutional runway than a single lab’s side project.
• Wanting neither runtime’s access level: A handful of lighter, more sandboxed OpenClaw alternatives are built specifically to wrap OpenClaw or Hermes in a harder security boundary rather than replace either, and sit alongside managed, no-code agent builder platforms if self-hosting either runtime isn’t the goal in the first place.

Whichever one you land on, the runtime is the easier decision to reverse. The tools and workflows you build around it are not, and that’s the next problem worth solving.

---

Expanding Both Agents with MCP Tools

Picking a runtime settles where the agent lives, not how it reaches the outside world. Wiring in web search, SEO data, email verification, or a CRM one integration at a time means separate credentials and separate maintenance for every service, no matter which agent you land on.

Both OpenClaw and Hermes already speak MCP natively, which is where a shared gateway earns its place. MCP360 puts more than 100 tools behind one integration and one API key, loaded on demand through search_tools and execute_tool rather than declared up front. For OpenClaw, that means routing its tool calls through one MCP endpoint instead of wiring each service by hand, and the same setup applies once you connect Hermes Agent to MCP360 directly.

Rebuilding tool wiring is usually what actually stalls a migration between the two, more than memory or skill imports ever are. Point both runtimes at the same gateway, and that step disappears.

---

Frequently Asked Questions

What is OpenClaw?

OpenClaw is an open-source, self-hosted AI assistant that runs as a background Gateway process on your own machine. It connects to messaging apps like WhatsApp, Telegram, and Slack, remembers context across sessions once configured, and can run shell commands, browse the web, manage files, and act on a schedule. It’s stewarded by the non-profit OpenClaw Foundation and licensed under MIT.

What is Hermes Agent?

Hermes Agent is Nous Research’s open-source, self-hosted AI agent built around a closed learning loop. Instead of starting fresh each session, it writes what it learns into persistent memory and reusable skills, then carries both forward automatically. It connects to more than 20 platforms from one gateway, including Telegram, Discord, and WhatsApp, and is free under the MIT license.

Is OpenClaw safe to use?

OpenClaw’s biggest disclosed flaw was CVE-2026-25253, nicknamed ClawBleed, a CVSS 8.8 remote code execution bug patched within days in version 2026.1.29. Since then, defaults have tightened, unknown senders now get a pairing code instead of automatic access, and sessions can run sandboxed. The bigger ongoing risk is its ClawHub skill marketplace, where malicious third-party skills have been caught stealing credentials before removal.

Is OpenClaw free to use?

The software itself is free under the MIT license. What you pay depends on which model you connect it to. OpenClaw supports subscription sign-in through Claude Pro/Max, ChatGPT/Codex, or GitHub Copilot, though Anthropic’s billing policy for third-party agent tools has shifted multiple times in 2026 and remains unsettled. Beyond the model, connecting real tools like search or CRMs adds its own cost. MCP360 consolidates that into one integration instead of several separate subscriptions.

Who owns OpenClaw?

OpenClaw was created by Peter Steinberger, who launched it in November 2025 under the name Clawdbot before it became Moltbot and then OpenClaw. In February 2026, Steinberger announced he was joining OpenAI, and stewardship of the project passed to the OpenClaw Foundation, an independent non-profit that now maintains it in the open under the MIT license.

Is Hermes Agent’s automatic memory a security risk?

It can be. A 2026 ICML benchmark that tested both agents directly found Hermes Agent’s memory poisoning attack success rate averaged 66.67 percent, against 34.25 percent for OpenClaw, because Hermes writes to memory more freely and injects it automatically at the start of every session. OpenClaw only pulls memory when the agent explicitly asks for it, leaving an attacker fewer chances to slip something in.

Can I migrate from OpenClaw to Hermes Agent?

Yes. Hermes Agent ships a built-in command, hermes claw migrate, that imports your existing OpenClaw memories, skills, command allowlists, and API keys in a single pass, with a dry-run flag to preview what will move before committing. The runtime switch itself is the easy part. Reconnecting the tools you had wired into OpenClaw is usually the slower step, and MCP360 is built specifically to avoid repeating that work when you switch agents.

Which one should I actually run, OpenClaw or Hermes Agent?

It depends on what you are already doing. Stay on OpenClaw if it is already running well on Telegram, Discord, or Slack. Switch to Hermes Agent if you want memory that improves on its own, using its migration tool to bring your setup over. Pick OpenClaw if you need the widest channel and skill coverage today. Neither is objectively safer. They carry different risks, so the answer depends on what each agent will be reading and doing for you.

Do OpenClaw and Hermes Agent work with MCP for external tools?

Yes, both connect to the Model Context Protocol natively rather than requiring custom scripts for every tool. That matters once you need real capabilities like web search, SEO data, or email verification, since wiring each one up separately means duplicate credentials per agent. MCP360 puts more than 100 tools behind a single integration and API key, so the same connection works no matter which agent you are running.

---

Conclusion

Both projects shipped a release in the past week, and both will likely have shipped another by the time this comparison is a few months old. Treat everything above as a snapshot, not a permanent verdict, and recheck the memory poisoning numbers and CVE history specifically if either agent will be reading content you don’t control.

The tradeoff that holds up over time isn’t which tool wins this quarter’s benchmark. It’s whether you’d rather manage a broader permission surface, including one flaw more severe than either project likes to advertise, or a more trusting memory system, and that answer depends on what you’re actually going to let the agent read.