Hermes vs. OpenClaw: A Practical Comparison

The category

Both projects are self-hosted personal agents: a persistent process on hardware you own, wired into your messaging apps, with real tools (shell, files, web, a browser), memory that survives restarts, and a skill library that grows. You message it from your phone; it acts on your machines.

That last part is why security dominates the comparison. A chatbot that answers wrong wastes your time. An agent with shell access that gets manipulated does real damage.

OpenClaw

Peter Steinberger launched OpenClaw as "Clawdbot" in November 2025. Anthropic objected to the name's similarity to Claude; it briefly became "Moltbot" before settling on OpenClaw at the end of January 2026. It crossed 100,000 GitHub stars within 48 hours of the rebrand. Two weeks later Steinberger joined OpenAI, and the project moved into an independent foundation with OpenAI backing, MIT license intact. It passed React's all-time star count in March and sits near 380,000 now.

Under the hood it's a long-running Node.js gateway: a local control plane for sessions, channels, tools, and events, with an embedded agent runtime handling the model calls. Personality lives in a file called SOUL.md. It speaks to 14+ LLM providers, from GPT, Claude, and Gemini down to local models over Ollama.

What you get:

• 28 messaging channels: WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Teams, SMS, WeChat, and 19 more
• Playwright-based browser automation
• Voice wake word and talk mode, with ElevenLabs text-to-speech
• Companion apps for macOS, iOS (including Apple Watch), and Android
• ClawHub, a community skill registry closing in on 68,000 skills
• Deployment guides for everything from a Mac mini to Kubernetes

The design goal is breadth: connect to everything, run everywhere, do everything. It's closer to an operating system for agents than a single assistant.

Hermes

Hermes comes from Nous Research, an independent AI research lab. It crossed 90,000 stars in its first two months and sits above 200,000 now. Its design center is different, and a line from a Kilo blog comparison captures it: "Hermes packages a gateway around a learning agent. OpenClaw packages an agent around a messaging gateway." Same parts, opposite center of gravity.

At Hermes' center is a loop that makes the agent better the longer you run it:

Memory in three tiers. Two tiny Markdown files (a 2,200-character MEMORY.md and a 1,375-character USER.md) injected at every session start; full-text search over every past conversation, stored in SQLite; and pluggable external memory providers if you want more. Critical facts stay always-loaded. Everything else is searchable on demand.

Skills the agent writes itself. When it completes a complex task, works through an error to a fix, or gets corrected by you, it saves the working procedure as a Markdown skill file. Next time it loads the proven procedure instead of rediscovering it.

A garbage collector for those skills. Self-written skills pile up into dozens of narrow, overlapping playbooks if nothing prunes them. A background pass called the Curator marks skills stale after 30 unused days, archives them after 90, and periodically reviews the library to merge overlapping ones. It never deletes; every change is recoverable.

Offline skill evolution. Agents grading their own work turns out to be unreliable (they almost always think they did great). So Hermes ships a separate pipeline, GEPA, that reads actual execution traces, finds where a skill fails, and evolves better variants through search. It costs a few dollars per run, needs no GPU, and ships its winners as pull requests you review rather than silent changes.

Profiles. Each profile is a fully isolated agent instance: own config, own memory, own skills, own credentials, own personality file. A coding agent and a research agent on the same machine share nothing by default.

The reach gap has narrowed. Over the spring Hermes added browser automation, a native desktop app for macOS, Linux, and Windows, and support for 20+ messaging platforms of its own, including Teams, iMessage, and WhatsApp. What it still lacks is OpenClaw's phone-native layer: no iOS or Android companion apps, no watch app, no voice wake word. Phone access means a messaging bot. The core difference is what each project treats as its center: OpenClaw grows by connecting to more places, Hermes by making the agent itself smarter.

Where they agree

Both keep personality in a SOUL.md file. Both treat skills as Markdown with frontmatter. Both schedule recurring work from plain-English cron requests, and both run local models over Ollama. Since spring, both do browser automation and both speak to twenty-plus messaging platforms. The two are converging quickly, so a feature table ages in weeks; treat the one below as a July 2026 snapshot.

Side by side

Security

This is the section that decided my choice, so it gets the most space.

OpenClaw's 2026 record. A CVSS 8.8 one-click remote-code-execution chain (CVE-2026-25253, patched in January); the "ClawHavoc" campaign, which seeded ClawHub with malicious skills until researchers counted more than 800 bad packages, at the time roughly a fifth of the registry; over 30,000 instances found exposed to the open internet without authentication; and infostealer malware specifically hunting OpenClaw config files, which hold API keys and tokens in plaintext. April brought a second RCE (CVE-2026-41295: open a workspace containing a malicious channel plugin and it executes before any trust check runs). In March, China restricted government agencies, banks, and state-owned enterprises from running OpenClaw at all.

The maintainers' response has been aggressive: pairing codes for unknown senders, a diagnostic doctor command, tool allowlists, VirusTotal scanning for ClawHub submissions. But the problem is structural. Twenty-eight inbound channels, a public skill registry, a browser, and shell access add up to a large attack surface that patching doesn't shrink. Every channel is a door. Every community skill is a supply chain. And the thing behind them executes commands.

Why Hermes is the safer bet. Several of Hermes' security advantages are structural rather than a matter of having fewer users:

• Profile isolation. Each profile is a fully isolated agent instance with its own config, memory, skills, and credentials. A compromise in one context doesn't hand over the rest.
• No central skill marketplace to poison. Skills arrive from GitHub repos you explicitly choose to trust (Homebrew-style taps) or from the agent's own hand. There is no shared registry an attacker can seed, so the ClawHavoc failure mode doesn't exist here.
• Reviewable self-improvement. Offline skill evolution ships its changes as pull requests you review, not silent edits.
• A hard 90-turn cap per task, so a hijacked loop can't run indefinitely.

The honest caveats: Hermes has fewer users, which means fewer attackers and fewer researchers looking, and its surface has grown as it added channels and a browser. Its July release notes list only dependency-level CVE fixes, with no incidents specific to it so far. But the structural properties above are the reason I trust it more on a machine that has to stay locked down.

The bottom line for either tool: treat it as untrusted software with shell access, because that's what it is. The most important security work happens at the machine and network level, underneath the agent entirely. That's what the next post covers.

Which one should you run?

OpenClaw if you want coverage: your agent on your phone and your wrist, answering by voice, controlling your browser and your speakers, with the largest community in the space. Budget real time for hardening — the defaults will not save you.

Hermes if you want an agent that compounds and a smaller, more auditable attack surface: it knows your environment in month three far better than in week one, keeps projects in separate profiles, and improves through a pipeline you can review. If the machine it runs on has to stay locked down, the supply-chain model and the isolation primitives are the point. I also preferred that it came from an independent research lab (Nous Research) rather than a project now backed by OpenAI. That's a governance consideration as much as a technical one.

What I run

A Hermes instance runs on an isolated machine here and drives product development for one of my side projects: prior-art research, planning, the unglamorous middle work. I steer and review; it executes.

The next post covers the setup that makes leaving it unattended reasonable: network isolation, tunneled access, firewall rules, and scoping what the agent can and cannot reach.