OpenClaw vs Hermes Agent: which AI agent should you run? (2026)
Hermes Agent or OpenClaw? Security defaults, memory, skills, channels, hosting and usage compared from each project's docs, plus a quiz that suggests a fit.
For most people starting fresh in October 2026, Hermes Agent is the better default: it shuts out every sender until you allow them, asks before running dangerous commands, writes its own skills and has an official hosted version. OpenClaw is the better pick if you want its iPhone and Android apps, need a skill or chat channel only it has, or already run a setup that works. If you’d rather not run and secure an agent at all, choose neither and look at the managed alternatives.
We haven’t run either agent ourselves. This comparison rests on each project’s documentation and GitHub data, OpenRouter’s public rankings and named press coverage, all read on October 20, 2026 (see how we work).
Who should pick which
- Pick Hermes Agent if you’re new to self-hosted agents, want strict defaults without configuring them, like the idea of an agent that turns repeated tasks into skills, or want a first-party hosted option.
- Pick OpenClaw if you want phone apps that lend the agent your camera, screen or location, need a ClawHub skill or a channel Hermes doesn’t list (X, Twitch or Nostr, for example), or have plugins, hooks and multi-agent routing you don’t want to rebuild.
- Pick neither if you don’t want to patch a server, manage allowlists or watch token bills; a hosted agent or a commercial assistant does that for you.
New to these agents? Start with what OpenClaw is and how it works.
OpenClaw and Hermes Agent side by side
Each row comes from the linked page, read on October 20, 2026.
| OpenClaw | Hermes Agent | |
|---|---|---|
| Maker | OpenClaw Foundation, a US non-profit; created by Peter Steinberger (foundation) | Nous Research (GitHub) |
| License, language | MIT; TypeScript on Node 24.16+ or 26.1+ (install) | MIT; Python (site) |
| GitHub stars, Oct 20 | About 392,900 (GitHub) | About 255,400 (GitHub) |
| Launch | First release Nov 25, 2025, as “warelay”; named OpenClaw Jan 29, 2026 (releases) | February 2026, per The Batch; first tagged release Mar 12, 2026 |
| Latest release | v2026.10.5, Oct 18, 2026 (GitHub) | v0.22.2, Oct 15, 2026 (releases) |
| Chat channels | 33 entries on its Channels page (our count) | 28 platforms in its messaging docs |
| Memory | Markdown notes and daily logs, searched by keyword and meaning (memory) | Two capped files plus full-text search of past sessions (memory) |
| Skills | Installed from ClawHub; docs say treat them as “untrusted code” (skills) | Writes its own; hub installs, ClawHub included, pass a scanner (skills) |
| Unknown senders | Must pair with a code first (pairing) | Denied unless allowlisted; pairing on DM platforms (security) |
| Shell commands | No allowlist or prompt by default; sandbox off (exec approvals, sandboxing) | Approval for dangerous commands on by default (security) |
| Install | One-line script, npm, Docker, Nix and more (install) | One-line script, PowerShell, desktop installers (GitHub) |
| Apps | macOS, Windows, iOS and Android (platforms) | Desktop app for macOS and Windows; no phone app listed (site) |
| Hosted option | None official; third parties such as Hostinger and Elestio | Hermes Cloud from Nous, $2 minimum credit (Nous Portal) |
| Models | About 70 provider pages (providers) | OpenRouter, Anthropic, OpenAI, Google, any OpenAI-compatible API, Nous Portal (integrations) |
| ChatGPT plan sign-in | Listed by OpenAI under “Open-source integrations” | Listed under “Apps with ChatGPT plan usage” (OpenAI) |
| OpenRouter tokens, last month | About 7.5 trillion (9th) | About 52 trillion (1st) (OpenRouter, data through Oct 19) |
Channel counts are each project’s own list, so they count differently. Both cover WhatsApp, Telegram, Discord, Slack, Signal, Microsoft Teams and iMessage. The OpenRouter row counts only traffic routed through OpenRouter, as explained below.
The design difference: an agent around a gateway, or the reverse
Brendan O’Leary of Kilo, which built a hosted OpenClaw service, summed it up in May: “Hermes packages a gateway around a learning agent”, while “OpenClaw packages an agent around a messaging gateway” (Kilo blog). That’s an opinion, but each project’s docs bear it out.
OpenClaw’s center is the Gateway, one process that owns every chat connection, routes messages to agents and lets Macs and phones join as “nodes” that lend the agent a camera, screen or location (architecture, nodes). Its breadth is in the plumbing: more channels, more apps, more routing.
Hermes’s center is the agent’s learning loop. Its system prompt asks the agent to save any non-trivial workflow as a skill for reuse (skills). According to The Batch, a background “Curator” archives skills unused for more than 90 days, and a judge model checks whether a goal was met. Kilo also points to /rollback, which restores files from a snapshot the agent takes before editing them.
The Batch reached a similar view: the two “largely overlap”, and Hermes “differs primarily in its memory architecture and ability to build skills automatically” (The Batch). So the choice comes down to defaults more than capabilities.
Security defaults compared
Who can message it. For direct messages, both start alike: an unknown sender gets an 8-character pairing code that expires in an hour (OpenClaw, Hermes). Hermes goes further: with no allowlist configured, its gateway denies all users, and it locks pairing after 5 failed attempts.
What it can run. This is where they split. On the machine running the Gateway, OpenClaw’s command settings default to full (“do not require an allowlist match”) and ask: off (“no ordinary policy prompts”), and its sandbox is “off by default”, so commands from your main session run on the host itself (exec approvals, sandboxing). It has an optional mode where a model reviews actions, but the default is full access (permission modes). Hermes turns on approval for dangerous commands by default, in a smart mode where a second model rates the risk. It fails closed if nobody answers within 300 seconds, and scheduled, webhook and API sessions deny dangerous commands outright. A --yolo flag switches these checks off, but not a hardline blocklist.
Where both need work. Hermes’s local terminal backend has no isolation either; its docs recommend Docker, Modal, Daytona or Vercel’s sandbox for production. OpenClaw’s Gateway listens only on the local machine, with a token, on normal installs, but its container images “default to an exposed bind” (security).
Track record. OpenClaw has had far more public scrutiny, and more findings: its security page counts 722 fixed and published advisories since January, 14 of them critical. CVE-2026-25253 (CVSS 8.8) allowed one-click token theft leading to remote code execution; it was fixed in 2026.1.29 (The Hacker News). Koi Security found 341 malicious skills among 2,857 it audited on ClawHub (The Hacker News). The Register noted that OpenClaw 2.0’s own patch notes say “Secret Store values are not encrypted at rest” (The Register). Kilo notes that Hermes had no reported agent-specific CVEs as of April 2026, but says that reflects smaller exposure, not inherent security.
So Hermes is safer as shipped. OpenClaw can be locked down with allowlists, approvals and a Docker sandbox, but you have to do it yourself; is OpenClaw safe? covers how.
Memory and skills compared
Memory: capped notes or a growing notebook
Hermes keeps two bounded files: MEMORY.md, capped at 2,200 characters, and USER.md, at 1,375. Both go into the system prompt at the start of a session, and the agent edits them with a memory tool. Past conversations sit in a SQLite database with full-text search that returns the actual messages, with “no LLM summarization, no truncation”, per the memory docs (the README says otherwise).
OpenClaw’s memory is a folder of Markdown: a curated MEMORY.md, loaded only in your private main session, and a log for each day. A memory_search tool finds notes by keyword, by meaning or both. Two automatic jobs keep it current: a save before long chats are compacted, and a background “dreaming” job that promotes items into MEMORY.md (memory). Injected files can run to 20,000 characters each and 60,000 in total (system prompt).
The trade-off: Hermes’s prompt-level memory is small and predictable, so it has to stay curated. OpenClaw holds much more but relies on search and background jobs to surface the right note. Kilo’s write-up of community complaints calls OpenClaw’s memory “unreliable” and names it the top reason users leave; those are user reports, not measurements.
Skills: written by the agent, or installed from a library
Both use the same SKILL.md format (AgentSkills). The difference is who writes them.
Hermes writes its own with a skill_manage tool, and by default it saves them without asking; set skills.write_approval: true to review each one first (skills). Kilo adds a caution: the agent’s self-evaluation almost always reports success, so a skill it writes can encode a mistake.
OpenClaw installs skills from ClawHub, its public registry; a security scan OpenClaw ran in June covered 67,453 public skills (OpenClaw blog). ClawHub scans releases automatically, but the docs still say to treat third-party skills as “untrusted code” (ClawHub). The library advantage is smaller than it looks: Hermes can install from ClawHub too, through its own scanner, which won’t let you force through a skill it rates dangerous. More in OpenClaw skills and ClawHub.
Ecosystem and momentum
OpenClaw is bigger; Hermes is growing faster.
- Stars. OpenClaw has about 392,900 GitHub stars to Hermes’s 255,400. On September 2, Star History counted 388,577 and 239,699 (Star History). By our arithmetic, Hermes gained about 15,700 stars in the seven weeks since, against about 4,400 for OpenClaw.
- Usage on OpenRouter. Hermes passed OpenClaw on OpenRouter’s app rankings by late May, according to The Batch (Turing Post says by June). In the month through October 19, OpenRouter shows Hermes first with about 52 trillion tokens and OpenClaw ninth with about 7.5 trillion (rankings). The caveat matters: this counts only traffic that apps route through OpenRouter and report to it, so anyone on a direct API key, a ChatGPT or Claude login, or a local model doesn’t appear.
- Switching reports. The Neuron cited Reddit sentiment surveys in May suggesting about 30% of OpenClaw users had moved to Hermes, for easier setup, better memory defaults and the learning loop (The Neuron). Kilo relayed community reports of roughly a 25% chance that an OpenClaw update breaks message delivery, cron jobs or webhooks. Both are informal: Reddit polls and anecdotes, not representative samples.
- Backing. OpenClaw has a non-profit foundation with paid staff and donors including OpenAI. OpenClaw’s blog says of Microsoft’s new Autopilot agent, “Its foundation is OpenClaw”, and NVIDIA’s NemoClaw installs OpenClaw by default (Autopilot, NemoClaw). After two faulty releases in late April, the project added a longer-supported “extended-stable” channel in July (rough week, extended-stable).
US Google searches for “openclaw” fell from about 1,000,000 a month in February and March to about 74,000 in August and September, per DataForSEO; the history in data has the full curve.
Switching from OpenClaw to Hermes
Hermes ships an importer, hermes claw migrate. It reads ~/.openclaw/ (and the older ~/.clawdbot/ and ~/.moltbot/ folders), shows a preview before applying anything, and zips a backup first (migration guide).
What moves:
- Persona and memory:
SOUL.md,AGENTS.md,MEMORY.md,USER.mdand the daily notes, merged into Hermes memory with duplicates removed. - Skills, into a separate
openclaw-importsfolder. - Your default model and custom providers. API keys move only with
--migrate-secrets, and only ten known keys such asOPENROUTER_API_KEY. - MCP servers, voice (TTS) settings, browser settings, the approval mode and the command allowlist.
- Bot tokens and allowlists for Telegram, Discord, Slack, Signal, Matrix and Mattermost. WhatsApp’s allowlist moves, but you pair again by QR code.
What stays behind (archived for you to review):
IDENTITY.md(merge it intoSOUL.mdby hand),TOOLS.md,HEARTBEAT.mdandBOOTSTRAP.md.- Cron jobs, plugins, hooks and webhooks, and memory-backend settings.
- Multi-agent lists, channel bindings and complex channel setups. Hermes uses profiles instead.
- Session reset timers. In Hermes a conversation continues until you type
/newor/reset.
Check three things afterwards. Approvals: the importer maps OpenClaw’s “auto” approval mode to “off”, which drops Hermes’s main safety default, so switch it back on. Memory: Hermes’s files hold far less than an OpenClaw MEMORY.md can, so read what survived the merge. Scheduled work: recreate your cron jobs and heartbeat checks in Hermes. Going back is partly possible: OpenClaw can import Hermes memory (memory).
Cost differences
Both are free; you pay for the model and the machine. Sourced comparisons are thin:
- The Batch reports that some users find Hermes “less token-efficient” than OpenClaw, without figures.
- Kilo’s community-reported range applies to either agent: about $1 to $3 a day on budget models and $130 or more a day on Claude Opus for heavy use, mostly because each message resends the conversation history.
The designs put costs in different places. OpenClaw’s heartbeat runs a full agent turn every 30 minutes by default, and its docs warn that “shorter intervals burn more tokens” (heartbeat). Hermes injects far less memory per session, but keeps a conversation open until you reset it, and its smart approval mode asks a second model to judge risky commands. Which ends up cheaper depends on your model and habits; we have no measurement that settles it. The OpenClaw cost calculator shows how much the model choice matters.
Subscriptions. OpenAI lists Hermes among “Apps with ChatGPT plan usage”, where requests count toward the ChatGPT Work and Codex allowance in your plan, with a weekly cap per app; OpenClaw is listed under open-source integrations, which “remain available to all ChatGPT users” (OpenAI Help Center). OpenClaw also documents reusing a Claude Code login; Anthropic’s Help Center said on October 7 that third-party apps still draw from subscription limits, while its Claude Code legal terms bar third-party developers from routing requests through Free, Pro or Max credentials. Nous’s own Portal plans for Hermes cost $20, $100 or $200 a month, each with 10% more in credits.
Hosting. Hermes Cloud bills compute by the second from a $2 minimum credit (or an active subscription); per-size prices appear only inside the Portal. OpenClaw has no official host. Among third parties, Hostinger’s managed one-click OpenClaw is $4.99 a month to start and renews at $11.99, paid upfront, and Elestio starts at $16 a month, as of October 2026. Or put either agent on a small VPS; see where to run OpenClaw and VPS and app hosting.
Which one should you run?
Each answer below adds points to the agent whose documented design matches it, and the result lists the reasons. It can’t check your particular skills or chat apps, so confirm those against the table.
Which agent fits you?
Six questions on hosting, security, skills, apps, memory and switching. The points follow the documented differences described in this article.
This follows the documented differences explained in this article, not a hands-on test. Change any answer to see how the suggestion moves.
FAQ
Is Hermes better than OpenClaw?
Not across the board. Hermes has stricter defaults, self-written skills, an official host and far more OpenRouter usage; OpenClaw has phone apps, more channels and a larger skill library. As The Neuron put it, “Hermes isn’t strictly better.”
Can I move my OpenClaw setup to Hermes?
Mostly. hermes claw migrate imports your persona, memory, skills, model settings, MCP servers and several channel tokens, and archives cron jobs, plugins, hooks, channel bindings and multi-agent setups for you to rebuild. API keys move only if you add --migrate-secrets.
Which is safer, OpenClaw or Hermes Agent?
Hermes, as shipped: it denies unknown users and asks before dangerous commands, while OpenClaw runs commands without prompts and with its sandbox off by default. Either can be hardened, and on a server either should run commands in a container.
Do both work with WhatsApp and iMessage?
Yes. Both list WhatsApp. For iMessage, OpenClaw has an official plugin and Hermes connects through BlueBubbles or Photon; OpenClaw’s docs treat iMessage as a macOS-only capability (macOS VMs), so plan on a Mac in the loop.
Can I run both?
Yes. Kilo’s Brendan O’Leary runs OpenClaw as the orchestrator with Hermes doing the work, connected through ACP. That doubles the setup and security work, so start with one.