Hermes vs OpenClaw: The Security Boundary Decides

OpenClaw and Hermes Agent are both MIT-licensed AI agents you host yourself, and their own documentation disagrees about where the safety boundary sits. OpenClaw puts it at the gateway: authenticate to it and you are trusted with everything it reaches. Hermes puts it around the command, inside a container. Pick by which of those you can live with.

Pick in one question: who starts the job?

If the answer is you, from a phone, with a request you have not written down yet, run OpenClaw. It is a gateway between chat apps and an agent, and nothing else does that as well: Discord, Slack, Telegram, WhatsApp, Signal, iMessage, Teams, Matrix, Google Chat, Zalo and a web chat, all served by one process.

If the answer is a clock, and the job repeats with small variations, run Hermes Agent. It ships a cron scheduler and seven execution backends, so the work can happen inside a container instead of on your laptop.

| | OpenClaw | Hermes Agent | | --- | --- | --- | | Shape | Gateway between chat apps and an agent | Agent runtime with a CLI, a scheduler and sandboxes | | Trust boundary | The gateway login | The container the command runs in | | Who starts a job | You, from a chat app | A cron entry, the CLI, or a chat app | | Isolation | Bring your own sandbox | local, Docker, SSH, Singularity, Modal, Daytona, Vercel Sandbox | | Extensions | ClawHub marketplace of plugins | Skills the agent writes after a task | | Owner | OpenClaw Foundation, a 501(c)(3) | Nous Research |

Both are MIT and run on hardware you own. The interface converges. The runtime decides, the same way the computer is the whole difference between Base44 and Replit.

What a gateway login grants

OpenClaw's trust model page is unusually plain about its own limits. "A caller authenticated to the Gateway is trusted at Gateway scope." Pair a phone and "node actions are trusted operator actions on that node." Then the line that should shape your setup: "Exec approvals (allowlist + ask) are guardrails for operator intent, not hostile multi-tenant isolation."

Read that as a design statement rather than a disclaimer. The approval prompts exist so you do not fat-finger a destructive command. They are not built to contain an agent that has been talked into one. The boundary is the gateway itself, and the docs say so in five words: "One Gateway is one trust boundary." Two levels of trust means two gateways.

That gateway is a WebSocket server on port 18789 by default, run as a launchd, systemd or Task Scheduler service. It binds to loopback and refuses to bind wider without auth, which is a sound default. It also describes a process that stays up, holding your channel credentials and sessions, and that property is the one to weigh.

What a container contains

Hermes moves the boundary one layer down, and its security page is worth ten minutes before you install. Command approval defaults to smart mode, where an auxiliary model rates risk. Prompts are fail-closed: if you do not answer in time, the command is denied. A hardline blocklist covering rm -rf /, fork bombs and mkfs on a mounted root runs regardless of yolo mode, regardless of approvals being switched off, regardless of a cron job running headless.

Then comes the sentence that decides how you configure it: "When running in docker, singularity, modal, daytona, or vercel_sandbox backends, dangerous command checks are skipped because the container itself is the security boundary."

The checks and the container are alternatives, not layers. Run Hermes on the local backend and you get approval prompts against your real filesystem. Run it in Docker and you get no prompts, inside a container started with cap-drop ALL and a 256 process limit. Both are defensible. Believing you have both at once is the mistake.

“

OpenClaw's boundary is the login to the gateway; Hermes's boundary is the container the command runs in.

”

The line to read before you pick a backend

Hermes keeps its state in ~/.hermes: config, an .env for secrets, auth.json for OAuth credentials, plus memories, skills, cron entries and logs. For the SSH, Modal and Daytona backends, that state is pushed into the remote sandbox for the session, and changed files are synced back when it tears down.

That is convenient, and it inverts what most people think they are buying. A remote sandbox keeps the agent away from your laptop. It does not keep your credentials away from the sandbox, because they travel there for the run. The local and Docker backends push nothing, so this is a choice you make per backend, not a property of the project. When the job touches email, the cleaner fix works for either agent: hand it an inbox of its own instead of yours, which is the entire premise of AgentMail.

On the OpenClaw side the same question points at third-party code. In January 2026 Cisco's AI threat research team took apart a skill that had climbed to number one in the skill repository and found nine security issues in it, two critical and five high, including a curl call sending data to a server the skill author controlled and a prompt injection telling the assistant to skip its own checks. They shipped an open source scanner with it. The conclusion is not that the marketplace is poisoned. It is that your plugin list is the file you audit, and breadth is what makes that list long.

Where each one is genuinely better

OpenClaw's advantage is reach, and it is not close. Eleven channels in core, more through plugins, plus paired iOS and Android nodes for camera, screen and voice. It is foundation-run, with "no paid tier, no telemetry by default beyond a version check you can turn off." If you want to text a machine from a train and have it act, that is the product, and going narrower is a real loss of range, which is the trade I walked through in one job, one exit door.

Hermes's advantage is repetition. The scheduler is built in and takes plain language, so a daily briefing at 8am becomes an unattended job without a cron expression. After a complex task the agent writes a reusable skill, and skills follow the agentskills.io standard rather than a house format, so they are not trapped in the tool. A scheduler is good at sending, though. It is not good at being present, which is what actually decides whether a scheduled post earns anything.

What each one costs you

OpenClaw costs you the upgrade path. The 2.0 release landed at the end of August 2026 as v2026.8.1, and the reports that followed split cleanly between clean installs, which went well, and in-place updates, which did not. That split, not the security argument, is what a month of the subreddit is really about.

Hermes costs you youth and self-written code. The runtime sits at v0.21.1, while OpenClaw has shipped since November 2025 under three successive names. A skill the agent wrote after solving something once is code you never reviewed, loaded again by default next time. And MIT covers the runtime, not your model access: the Nous Portal bundle of 300+ models is a paid tier, so free describes the software rather than the bill.

The choice, stated honestly

It is not a feature race. It is a gateway you log into against a container the work runs inside. Decide which failure you would rather explain to yourself: a caller who reached your gateway, or a container that held your credentials for ten minutes. Install that one, point it at an account you can burn, and give it exactly one irreversible verb to start with.

FAQ

Can I run both? Yes, and the split is reasonable: OpenClaw for the chat surface you reach from a phone, Hermes for the jobs a clock starts. Two always-on listeners is the thing to avoid, so keep the scheduled agent headless and let only one of the two listen.

What stops a stranger from messaging my agent? On Hermes, an unknown sender gets an 8 character pairing code that expires in an hour, which you approve from the CLI, with a one hour lockout after five failed attempts. On OpenClaw, the equivalent controls are allowlists and a requirement to be mentioned in group chats.

Do I need a server for either? No. Both run on a machine you already own. A small VPS is what you buy when the job has to fire while your laptop is closed, and for Hermes the Modal, Daytona and Vercel Sandbox backends cover that case without a machine of your own.