Hermes Agent vs OpenClaw 2026: Security, Cost, Verdict

A first-principles comparison of the two biggest open-source AI agents after their August 31 releases: how each is built, what each learns, what each costs, where the security records really differ, and which one to run for which job.

Hermes Agent pushed 10.74 trillion tokens through OpenRouter in the week to September 10, nine times OpenClaw's 1.19 trillion. Yet OpenClaw still holds 389,423 GitHub stars to Hermes's 244,346, read from the GitHub API on September 11 - GitHub API. The two usage numbers people quote point in opposite directions, and both projects just shipped the largest release in their history on the same weekend: OpenClaw 2.0 on August 30, built from 16,977 pull requests, and Hermes Agent v0.21.0 "Pantheon" on August 31, built from about 2,475 - OpenClaw release notes. Three days later, at IFA in Berlin, NVIDIA named both, alongside Perplexity's Portable Computer, as the agent apps getting simplified local model setup on Windows PCs - NVIDIA Blog.

But here is the problem: the two projects are built on opposite bets about what an agent is, and neither the stars nor the tokens tell you which bet fits you. OpenClaw is a control plane: a Gateway that owns credentials, routing and approvals, pushes work out to sandboxes, devices and cloud workers, and since 2.0 lets a whole team share live sessions. Hermes is a learning loop: one Python agent that writes its own skills after hard tasks, keeps a small, curated memory of you, and now runs as a society of named bots that message each other. One project has 722 published security advisories and a record of supply-chain attacks on its skill registry. The other has zero published advisories of its own, 44 CVEs filed by third parties, and a fix for a remote code execution flaw that shipped only after six unanswered contact attempts.

This guide breaks down what each release changed, what the stars and token numbers actually measure, the architecture and defaults line by line, the memory and skills systems, the full security record, what NVIDIA and Microsoft actually announced at IFA, what each one costs at today's model prices, how to set each one up safely, the governance question behind both, the rest of the field, and a decision framework. It assumes no technical background. Every GitHub figure was read from the GitHub API on September 11, 2026, every OpenRouter figure comes from OpenRouter's own data API as of that morning, and every model name was checked against the providers' live model documentation the same day.

Contents

1. The Verdict Up Front: A Weighted Scorecard
2. First Principles: What an Open Agent Actually Competes On
3. August 31: Two Record Releases in One Weekend
4. Stars vs Tokens: What the Adoption Numbers Measure
5. Architecture Head-to-Head: Control Plane vs Learning Loop
6. Memory and Skills: Where Hermes Learns and OpenClaw Curates
7. Channels, Apps, and Ecosystem: Reach vs Depth
8. Security: The Full Record, and What It Means
9. IFA 2026: What NVIDIA and Microsoft Actually Announced
10. What It Costs to Run: Plans, Tokens, and Subscriptions
11. Setting Up Each One Safely
12. Governance: Foundation vs Venture-Backed Lab
13. The Rest of the Field, and Where Both Fall Short
14. Use Cases: Who Should Pick Which
15. The Road Ahead
16. Conclusion: The Decision Framework

1. The Verdict Up Front: A Weighted Scorecard

Most comparisons of these two projects end with a shrug: OpenClaw for orchestration, Hermes for learning, pick one. That answer is not wrong, but it does not help a reader decide, because it does not say how much each difference weighs. So this guide scores both agents on five criteria built from what a person running one actually feels in the first ninety days: what it can do on day one, how much better it gets over time, whether it can be trusted with your accounts, what it costs, and whether the ecosystem and the people behind it will still be there next year. Every cell carries the evidence behind the score, and the weights are printed so you can disagree with them.

The result is a near tie, and the tie is the finding. On these weights OpenClaw scores 7.10 and Hermes 7.05, a gap of one twentieth of a point, so the final column is shown to two decimals rather than rounding both to 7.1 and hiding the order. The two projects win and lose on completely different criteria, which is why the weights you choose decide the winner. The table below uses the standard weights; the second table shows what happens when you weight for a solo operator or for a team.

Day-one capability (20%) measures what the agent can do the afternoon you install it: channels, devices, tools and execution options. Learning over time (20%) measures how much better it gets at your work by day ninety without you writing its instructions. Security posture (25%) weighs the design, the defaults and the disclosed record together, and it carries the most weight because both agents act with your credentials. Cost to run (15%) is the realistic monthly bill: hosting plus tokens under normal use. Ecosystem and governance (20%) covers skills, contributors, backers, release discipline, and how the project behaves under pressure. Scores run from 0 to 10, the final is the weighted average, and the table is sorted by final score.

The weights are the argument, so here is the same scoring under two other sets. A solo operator who wants an agent that gets better at their own recurring work might weight learning at 30% and ecosystem at 10%. A team that needs shared sessions and an accountable maintainer might weight day-one capability at 25%, ecosystem and governance at 30%, and learning at 10%. The scores in every cell stay the same; only the weights change.

Two things deserve saying plainly before the deep dive. First, both security scores are a 5 for different reasons: OpenClaw has the better-engineered controls and the far longer vulnerability history, while Hermes has safer defaults and a worse record of responding to researchers. Section 8 walks through both. Second, Hermes's low governance score is not about code quality. It reflects a project where contributions arrive far faster than they can be reviewed and where one company, and to a large degree one person, decides what lands. The rest of this guide is the evidence behind each cell.

Why this matters: a single winner would be the wrong answer to the wrong question, because the two agents are strongest for different people. How to apply this: find the weighting row that looks most like you. If the agent will serve only you and you want it to get better at your recurring work, the solo-operator row applies and Hermes leads by more than half a point. If it will serve a team, touch shared accounts or need someone accountable behind it, the team row applies and OpenClaw leads by three quarters of a point. If you are unsure, the standard row says the choice is close enough that the specific job, covered in Section 14, should decide it.

2. First Principles: What an Open Agent Actually Competes On

Start with the structural question rather than the feature list. Both projects call the same frontier models. OpenClaw's onboarding sets a fresh OpenAI account to openai/gpt-5.6-sol, and its September 5 release added GPT-6 Astra and Meta's Muse Spark 1.3 - OpenClaw release notes. Hermes routes through Nous Portal to more than 300 models, or to any provider you configure, and Pantheon added six more providers including Meta's - Hermes Agent docs. So neither competes on intelligence. Intelligence is an input they both buy by the token, often at the same price, from the same handful of labs. What they compete on is everything wrapped around the model call: the harness.

A harness does four jobs a bare model cannot. It decides what runs where (your laptop, a container, a cloud worker) and therefore what a misbehaving model can reach. It decides what persists between conversations, which is the difference between a chatbot and a colleague. It decides how capability accumulates, whether through people writing instruction files or through the agent writing its own. And it decides who can talk to it, through which apps and with what permissions. Every real difference between Hermes and OpenClaw is a different answer to one of those four questions, and every security incident either project has had maps onto one of them.

OpenClaw's answer is a trusted core with untrusted edges. The Gateway owns channel connections, configuration, credentials and approvals; execution can be pushed out to sandboxes, paired devices or cloud workers. This is the architecture of a server, and it explains why OpenClaw 2.0 grew into shared team sessions rather than a smarter individual agent. Once you have built a control plane, the natural next feature is more people on it. It also explains the project's security history: a control plane that holds every credential is the most valuable thing on the machine to attack, so its failures have been exposure failures.

Hermes's answer is a closed loop that compounds. One process runs the model, reads and writes a small memory, writes skills when it learns something, and schedules its own recurring jobs. This is the architecture of an apprentice, and it explains why Hermes grew into cron jobs that remember their last run and bots that delegate to each other rather than into team dashboards. Once you have a learning loop, the natural next feature is more things for it to learn from and more copies of it to divide work. Its failures are learning failures: the agent can be taught the wrong thing by a document or web page it read, and remember it.

Why this matters: the two designs fail differently, and the failure you can tolerate should decide your pick. A control plane fails by being reached by the wrong person; a learning loop fails by learning the wrong lesson. How to apply this: if your agent will act for other people (a team, a family, a shared inbox, customers), engineer against the control-plane failure, and OpenClaw gives you more levers for that. If the agent is yours alone and you want it better at your work each week, guard against the learning-loop failure, and Hermes gives you approval gates for both memory and skills. The rest of the guide tests that framing against the evidence, starting with the two releases that reset the comparison.

3. August 31: Two Record Releases in One Weekend

Both projects picked the same weekend to ship the biggest release in their history, and the two releases say more about the projects than any feature table. They were built by different kinds of organization, at different speeds, for different users, and it shows. Reading them side by side is the fastest way to understand where each project thinks the value is.

OpenClaw went first. The foundation announced OpenClaw 2.0 on Sunday, August 30, in a post titled "OpenClaw 2.0, Accidentally," and described it as "by far the largest update in the history of OpenClaw" - OpenClaw. The post says the release was built by 933 contributors, 569 of them first-timers, from more than 16,000 pull requests, after the project had shipped 106 releases in 230 days and then gone nearly seven weeks without one. The official release notes, which title the version "v2026.8.1 (AKA OpenClaw 2.0)," give a slightly larger count: 16,977 pull requests, 698 direct commits and 987 contributors - OpenClaw release notes. The project's chief architect, Vincent Koc, summarized it as "50% of all PRs since project inception in this one release" - InfoQ.

Hermes followed about sixteen hours later. Hermes Agent v0.21.0, tagged v2026.8.31 and called "The Pantheon Release" in its notes, reports roughly 5,800 commits, about 2,475 merged pull requests, some 869,000 inserted lines, about 2,100 closed issues and more than 760 contributors since v0.20.0 - Hermes Agent releases. Its headline features are Bot Mode built into the desktop app (named agents with avatars that work together in group chats), a hermes peer command for bot-to-bot messages, cron jobs that remember their previous runs, live steering of running subagents, an MCP command center, an agent that can drive the desktop app's built-in browser, and six new model providers, including Meta's Muse Spark.

What each release actually changed

The OpenClaw release is about two things: getting people started and letting teams share. First-time setup now starts "with what is already on someone's computer, including existing ChatGPT or Claude subscriptions, API keys, and local models," and the rest of the configuration happens in conversation with the agent instead of a wizard - OpenClaw. The browser app was rebuilt so it opens straight into a conversation. Shared cloud sessions let a teammate join live work or take it over with the context intact, and sessions can now run on paired devices or cloud workers and come back to the main machine later - OpenClaw releases.

The security additions are real and carefully hedged. An agent can ask for a credential through a masked prompt, so the value never enters chat or model context. A team-scoped Secret Store can inject a protected credential into an approved HTTPS request without the model seeing it. Recurring jobs can get a permission for one exact operation that has to be approved again if the job changes. The release's own security notes also list what these features do not cover: Secret Store values "are not encrypted at rest," credential substitution does not apply to "raw sockets, containers, remote nodes, provider-native harnesses, plain HTTP, and WebSockets," and "direct execution remains the default" - OpenClaw security and privacy notes.

The Pantheon release is about something else: making one person's agent more capable over time. Bot Mode turns a single Hermes install into a small team of named agents that can talk to each other. Cron jobs now carry memory between runs, so the Monday report knows what last Monday's report said. Live steering lets you list, redirect or stop running subagents while they work. The in-app browser gives the agent a visible browser it can operate on the desktop. The ten days before the release brought related pieces in a patch rollup of about 525 pull requests: consent-gated browsing with your real browser profile, 50+ remote MCP servers, and opt-in encryption of stored secrets in the operating system's keychain - Hermes Agent releases.

The most-watched walkthrough of the Pantheon release came from the Superbash channel within hours of the tag, and it shows the Bot Mode roster and group chats on screen, which the release notes can only describe. It is an independent creator video, and it includes a sponsor segment at 3:33.

The cron segment is the part to watch if you run recurring jobs. A scheduled Hermes job that loads its own memory and carries the previous run's output forward behaves less like a script and more like an assistant with a notebook, which is the concrete meaning of "self-improving" in day-to-day use.

The clearest way to see the difference in scale is to count pull requests. The chart below compares the pull requests each release reported with the pull requests each repository merged in the eleven days after its release, read from the GitHub search API on September 11.

OpenClaw's release was about seven times larger by pull request count, and in the eleven days that followed the foundation merged another 6,814 pull requests and shipped five more feature releases: a Linux desktop companion on September 1, a quick-start lane that detects existing Claude Code or Codex logins on September 3, GPT-6 Astra and Muse Spark 1.3 support on September 5, rehearsed updates on September 8, and plugin and skill discovery plus "visible learning from past conversations" on September 11 - OpenClaw release notes. Hermes shipped one patch release in the same period, v0.21.1 on September 7, with 632 merged pull requests focused on splitting up the codebase and improving performance - Hermes Agent releases.

How the rollouts went

Feature lists do not tell you whether the upgrade broke anyone's setup, and that is where the two releases differ most. OpenClaw 2.0 moved sessions and transcripts into SQLite and reworked approvals, and it had a rough first week. The release notes themselves tell users that "if the automatic update fails, use a local coding harness to help complete the update" - OpenClaw releases. InfoQ reported that some users "experienced migration problems, broken gateways, lost automations, or model authentication issues after updating" - InfoQ. On GitHub, an issue titled "2026.8.1 upgrade crash-loops the Gateway" was one of 83 issues with the release number in their title opened in its first week - GitHub issue #133813.

OpenClaw has had rough releases before and has been open about them. In May the foundation published an apology for a run of releases in which "Gateways got slower" and some installs "got stuck in plugin dependency repair loops" - OpenClaw. The foundation also keeps an Extended Stable line for people who cannot absorb that churn: v2026.6.35, the last June long-term-support release, shipped on September 10 with backported fixes only - OpenClaw releases. Hermes has no equivalent long-term-support channel. It ships one main line with patch rollups, which is simpler to follow and gives you nowhere to wait out a bad release.

Why this matters: a release tells you who the maintainers think the user is. OpenClaw 2.0 was built for teams: shared sessions, standing approvals that someone else can inspect, workers that run in the cloud while the durable record stays on the Gateway. Pantheon was built for one person with several agents, where the value is in agents that remember, specialize and hand work to each other. How to apply this: if you run OpenClaw in production, wait for the 2026.9 line to settle or stay on Extended Stable, and run openclaw doctor --fix with a backup before upgrading. If you run Hermes, move to v0.21.1 rather than v0.21.0, and read the release notes for provider changes before you update a machine that runs unattended cron jobs.

For a creator's walkthrough of what 2.0 feels like in daily use, Alex Finn's release-day video is the most-watched of the week, and it ends with a direct comparison of OpenClaw, Hermes and Grok Bot. It is an independent creator video rather than an official one, so treat the verdict as one experienced user's opinion.

The demo section shows the rebuilt browser app and a cloud session starting from a prompt, which is the part of 2.0 that prose describes least well. The comparison at the end reaches the same conclusion the rest of this guide reaches by a different route: the right choice depends on whether the agent is for a team or for one person.

4. Stars vs Tokens: What the Adoption Numbers Measure

This is the section where the two most quoted numbers point in opposite directions, and where understanding why matters more than the numbers themselves. A GitHub star is a free, one-time click. A token on OpenRouter is metered usage that someone pays for. A project can collect stars for months off one viral moment, and a project can process enormous volume with fewer stars if its users run it hard every day. Both numbers are real. They measure different things.

On stars, OpenClaw is far ahead. The GitHub API on September 11 showed 389,423 stars and 81,855 forks for OpenClaw against 244,346 stars and 50,575 forks for Hermes, a lead of about 59% - GitHub API. OpenClaw got there in under ten months: the repository was created on November 24, 2025, and it already had more than 100,000 stars when the project announced the OpenClaw name on January 29 - OpenClaw. Hermes is older, created in July 2025, but grew later. Yicai Global counted more than 85,000 stars in mid-April - Yicai Global. By July 13, when TechCrunch reported on Nous Research's fundraising, the count was about 214,000 - TechCrunch.

On metered usage, Hermes is far ahead. OpenRouter publishes a ranking of the apps that send traffic through it, and its data API shows Hermes Agent at #1 with 10.74 trillion tokens in the week of September 4 to 10, against OpenClaw at #8 with 1.19 trillion, a ratio of 9.06 - OpenRouter app rankings. Over the last thirty days the ratio is 10.6. Claude Code, Cline, Kilo Code and several other coding agents now sit between them. Hermes first beat OpenClaw on a single day on May 8, and by OpenRouter's count it passed OpenClaw's cumulative total on July 9.

The chart below shows the weekly series from OpenRouter's data API, from OpenClaw's peak at the end of March to the most recent full week. It is the single most revealing picture in this comparison.

Two things stand out. Hermes grew roughly sixty-fold in five months, peaking at 15 trillion tokens in the week of August 21. OpenClaw's OpenRouter traffic fell about 80% from its peak in the week of March 27 and has been flat at about one trillion a week since June. That fits VentureBeat's observation that interest in OpenClaw "has cooled off substantially from its peak in March 2026" - VentureBeat. At roughly 8.7% of all OpenRouter tokens that week by our calculation from OpenRouter's daily data, Hermes is one of the largest single sources of traffic on the platform.

Why neither number settles it

The token chart is not the whole story either, and the reason is structural. OpenRouter only counts traffic that flows through OpenRouter, from public apps that opt into tracking, and its own documentation warns that token counts come from each provider's tokenizer, "so cross-app comparisons are approximate" - OpenRouter data API docs. OpenClaw 2.0's onboarding deliberately starts from what is already on the user's computer, including "existing ChatGPT or Claude subscriptions, API keys, and local models," and subscription and local-model traffic never shows up on OpenRouter. OpenAI has let ChatGPT subscribers sign in to OpenClaw since May, so some share of OpenClaw's model traffic, how much is not published, runs through a subscription OpenRouter never sees.

Install numbers point the other way. The official openclaw npm package averaged about 583,000 downloads a day on the days npm recorded in early September (npm's own figures show zero on three days that week, so the published weekly total of 2.33 million is an undercount) - npm downloads API. Hermes cannot be compared on this measure, because its official installer clones the GitHub repository rather than installing from a package registry, and its PyPI package is several versions behind. The foundation says 4.5 million new claws are created every week; that is a self-reported figure, but it is consistent with the npm volume.

So the honest reading is this: stars measure curiosity, package downloads measure trial, and OpenRouter tokens measure one slice of commitment, the slice paying per token through one gateway. OpenClaw wins the first two by a wide margin. Hermes wins the third by nearly an order of magnitude, and it is growing while OpenClaw's share of that slice shrinks. The gap on OpenRouter overstates the real usage gap by an amount nobody outside the two projects can measure, but the direction of travel is not in doubt: among people who pay per token for an open agent, Hermes has become the default.

Why this matters: a reader choosing between the two should weight the number that matches what they care about. If you want the biggest community, the most tutorials and the most third-party integrations, stars and installs are the better proxy, and OpenClaw wins. If you want to know which agent heavy users are running day after day, per-token usage is the better proxy, and Hermes wins. How to apply this: do not choose on either number. Use them to predict what support you will find (OpenClaw's community is larger) and where new features will land first (Hermes's heavy users are pulling it toward long-running, multi-agent work). For how routing traffic through a gateway like OpenRouter changes what you pay, see our guide to AI model routing.

5. Architecture Head-to-Head: Control Plane vs Learning Loop

The cleanest way to see the two designs is to follow one message from your phone to a shell command and back. In OpenClaw, the message arrives at the Gateway, a single long-running process that listens on port 18789 and that the docs describe as the bridge "between your messaging apps and an always-available AI assistant" - OpenClaw docs. The Gateway checks who sent the message (unknown senders on most chat channels get a pairing code first), picks the agent and workspace, and makes the model call. When the model wants to run a command, the Gateway runs it on the host by default, or hands it to a sandbox backend if you configured one: Docker, Podman, SSH or NVIDIA's OpenShell - OpenClaw sandboxing docs.

Everything else in OpenClaw hangs off that Gateway. Companion apps on macOS, iOS, Android and, since September 1, Linux connect to it as nodes that add device-local actions, including computer use on paired Macs and enabled Windows machines. Cloud workers can take over a session in a selected repository and hand it back later. The 2.0 security features (masked credential prompts, the Secret Store, standing approvals) live in the Gateway and apply to every agent behind it. The docs are clear about the limits of that model: OpenClaw "is not a hostile multi-tenant security boundary for mutually adversarial users sharing one agent or gateway" - OpenClaw security docs. It is a trust boundary for one person or one team.

In Hermes, the same message also arrives at a gateway process, but that gateway is thin. It is the messaging adapter layer that lets one agent live on Telegram, Slack, WhatsApp, Signal, email and a couple of dozen other platforms at once. The substance is the agent loop behind it: a single Python program that holds the tool registry, the memory files, the skills directory, the cron scheduler and the subagent spawner. Its README calls it "the only agent with a built-in learning loop" - Nous Research. When the model wants to run a command, Hermes checks it against dangerous-command rules and, by default, has an auxiliary model approve low-risk commands, deny dangerous ones, and ask you about the rest.

Where the command runs is a separate choice in Hermes, set by one key. The terminal.backend setting accepts seven backends: local, Docker, SSH, Modal, Daytona, Vercel Sandbox and Singularity, and the default is local, which means your own machine with no isolation - Hermes configuration docs. When you pick one of the container or cloud backends, Hermes skips its dangerous-command checks entirely, because it treats "the container itself" as the security boundary - Hermes security docs. The serverless backends, Modal and Daytona, hibernate when the agent is idle, which matters for cost.

The subagent story is where the two designs are converging fastest. OpenClaw thinks in terms of persistent agents bound to channels, each with its own workspace and sessions, plus cloud workers that act as borrowed compute. Hermes thinks in terms of a parent that spawns isolated children, and Pantheon made that model much richer: delegate_task can now list running children, steer one mid-flight, stop it early and keep the partial result, validate a child's output against a JSON schema, and report the cost of each delegation, with defaults raised to 250 iterations and 10 concurrent children - Hermes Agent releases. Bot Mode then gives those agents names, avatars and group chats. In the spring the two were easy to sort into orchestration versus learning; by September each has borrowed the other's headline feature.

Defaults decide more than design

Architecture tells you what a project can do. Defaults tell you what most installations actually do, and here the two projects differ in ways that are easy to miss. An OpenClaw Gateway on a normal host binds to loopback, so it is not reachable from the network unless you expose it, and unknown chat senders must be paired - OpenClaw security docs. But host command execution defaults to "full" security mode with approval prompts off, so the agent runs commands on your machine without asking, and the docs recommend switching to tools.exec.mode auto - OpenClaw exec approvals docs. Sandboxing is off by default, and the 2.0 release notes repeat that "direct execution remains the default."

Hermes makes the opposite trade on the first point and a looser one on another. Its local backend also runs on your machine, but the default approval mode is smart, so risky commands are checked and genuinely dangerous ones are refused or put to you, and a hardline blocklist (deleting the root filesystem, fork bombs, formatting disks) applies in every mode with "no override flag" - Hermes security docs. Network isolation goes the other way. OpenClaw's Docker sandbox defaults to no network access at all, while Hermes's Docker backend has network access on by default and needs docker_network: false to cut it off - Hermes configuration docs.

Neither set of defaults is safe to leave alone. The table below puts the defaults that matter side by side, as they appear in each project's documentation on September 11.

Why this matters: architecture is destiny for what breaks. OpenClaw's Gateway is a high-value target because it holds everything, which is why exposed Gateways have been the project's recurring problem. Hermes's single process is a smaller target, but every safety check runs inside the same process the model is steering, with no separate trust boundary unless you choose a container backend. How to apply this: on OpenClaw, treat the Gateway like a database server, switch exec to auto, turn on sandboxing for anything that touches untrusted input, and never put the port on the public internet. On Hermes, pick a container or serverless backend on day one and set docker_network: false for jobs that do not need the internet. For a broader look at where agents should execute code at all, see our E2B vs Modal guide, which covers the serverless sandboxes Hermes now supports natively.

6. Memory and Skills: Where Hermes Learns and OpenClaw Curates

If architecture is the skeleton, memory and skills are the nervous system, and this is where the two projects differ most in philosophy and least in mechanics. Both store long-term memory in plain Markdown files. Both load skills from SKILL.md files that follow the same open format. Both can search past conversations with a SQLite full-text index. The difference is what the agent may change on its own, and how much of its memory the model sees at once.

Hermes keeps two memory files, and the limits are exact: MEMORY.md is capped at 2,200 characters, about 800 tokens, for environment notes and learned conventions, and USER.md at 1,375 characters, about 500 tokens, for your preferences - Hermes memory docs. Both are injected into the system prompt as a frozen snapshot when a session starts. When a write would go over the cap, the agent has to consolidate rather than silently drop older notes. Everything else lives in a SQLite database with full-text search that covers every CLI and messaging session, and Hermes ships eight optional external memory providers for people who want a larger store.

Those caps are the most honest and the most criticized part of Hermes. The criticism is that "persistent memory" turns out to mean two small text files. The defense is that the cap forces the agent to curate, and curation is the learning: an 800-token memory the agent has rewritten forty times knows more about you than a 40,000-token log it never rereads. Whether that trade suits you depends on whether you want an agent that remembers everything or one that remembers what matters.

OpenClaw's memory is layered and larger. The workspace holds USER.md (with its own 4,000-character budget), MEMORY.md for durable facts and decisions, a dated memory/YYYY-MM-DD.md file of daily notes, and an optional DREAMS.md - OpenClaw memory docs. "Dreaming," a background process that promotes notes from the daily files into MEMORY.md, is on by default. The built-in memory engine is a per-agent SQLite index that combines keyword search with vector search, using OpenAI embeddings by default and falling back to keyword-only search if no embedding provider is set - OpenClaw memory engine docs. Our survey of AI agent memory architectures covers the vector-versus-file trade-off both projects are working through.

Skills: who writes the procedures

Skills are where Hermes makes its central claim, and it helps to be precise about what the claim is. In Hermes, the agent has a skill_manage tool that can create, patch, edit and delete skills on its own, and the docs call this "the agent's procedural memory" - Hermes skills docs. It writes a skill after it finds a working approach to a hard task or absorbs a correction from you. A /learn command turns a reference document into a skill. Skills load in stages, so the list of names and descriptions costs about 3,000 tokens and the full text is fetched only when needed. By default these writes happen freely; with skills.write_approval: true, every skill change is staged for you to review with /skills diff and /skills approve.

OpenClaw started from the opposite end and is moving toward the middle. A skill is a Markdown file that a person writes or installs, and the Gateway adds a compact entry for it to the prompt at about 24 tokens per skill - OpenClaw skills docs. The newer Skill Workshop changes who drafts them: "when the agent spots reusable work, it drafts a proposal instead of writing directly to SKILL.md," and a person inspects, evaluates and applies it from the CLI. The September 11 release goes further, letting you "turn past conversations into reusable skills through a chat you can steer" - OpenClaw release notes. So both agents now propose their own skills. The difference is the default: Hermes writes and lets you gate, OpenClaw proposes and waits for you.

The Pantheon release tightened one related door. Writes to protected instruction files (the release names AGENTS.md, skills and memory stores) "now always require write approval so a prompt-injected agent can't quietly rewrite" its own instructions - Hermes Agent releases. That closes the most obvious attack on a learning agent: a hostile web page or document that talks the agent into editing the files that define its behavior. The less obvious one remains, which is the agent faithfully learning a wrong or poisoned lesson through its normal memory and skill tools. That risk is inherent to learning, and the gate is the only real control.

Both designs are converging on the same pressure. A long-running agent that keeps everything pays for it on every call and gets worse at finding what matters, which is why Hermes caps memory instead of growing it, and why OpenClaw added dreaming to compress daily notes into a smaller durable file. The two projects reached similar answers to the same problem from opposite starting points: Hermes forces the agent to curate from the first day, while OpenClaw lets notes accumulate and consolidates them in the background. For a single user the Hermes approach is cheaper per call and easier to audit, because the whole memory fits on one screen. For a team the OpenClaw approach is safer, because a daily log and a separate reviewed summary make it easier to see where a remembered fact came from.

Why this matters: the skills question is the whole comparison in miniature. Human-reviewed skills are reproducible and safe to share across a team, which is why a marketplace could grow around them, and why that marketplace could be poisoned. Self-written skills are personal and adaptive, which is why they make one operator faster, and why a security team will want the approval gate on. How to apply this: on Hermes, turn on memory.write_approval and skills.write_approval for the first month, read what the agent wants to remember, and relax the gates only for categories it gets right. On OpenClaw, use the Skill Workshop queue instead of letting skills accumulate unreviewed, and read every ClawHub skill before installing it. Our ranking of AI agent skills that deliver value and our Agent Plugins 1.0 article cover the cross-harness skill format both projects now use.

7. Channels, Apps, and Ecosystem: Reach vs Depth

An agent you cannot reach is an agent you do not use, so the channel list is not a vanity metric. By September both projects cover nearly the same ground. OpenClaw's channel directory lists more than thirty integrations, from WhatsApp, Telegram, Slack, Discord, Signal, Microsoft Teams and native iMessage to Feishu, LINE, QQ, WeChat, WeCom, Yuanbao, Zalo, Nostr and SMS, most as official plugins and a few as external ones - OpenClaw channels docs. Hermes's messaging docs list 28 platform entries from one gateway, including Telegram, Discord, Slack, WhatsApp, Signal, email, SMS, Matrix, Mattermost, DingTalk, Feishu/Lark, WeCom, Weixin, QQ, Yuanbao, Microsoft Teams, LINE, Home Assistant and iMessage through BlueBubbles or Photon - Hermes messaging docs.

So the difference is not the list. It is what sits behind it. OpenClaw has native companion apps for macOS, iOS, Android and even Apple Watch that act as device nodes with camera, screen, location and voice, a Linux desktop companion since September 1, a browser app that became the primary interface in 2.0, and shared cloud sessions for teams - OpenClaw nodes docs. Hermes has Hermes Desktop, a free MIT-licensed app for macOS 12+, Windows 10/11 and Linux that launched as a public preview on June 2 and now hosts Bot Mode, the MCP command center and the agent-driven browser - Hermes Desktop. There is no Hermes phone app; the phone is whichever chat app you already use.

The OpenClaw 2.0 browser app is the most visible expression of the control-plane idea, because it turns the Gateway into a place you work in rather than a service you message. The screenshot below is from the foundation's launch post and shows the new composer with the session's location, permission mode and model selectors in view.

Note the permission selector reading "Default (Full access)" and the model reading gpt-5.6-sol. Both are the defaults discussed in Section 5 and in the cost section below, shown in the product's own launch screenshot: full access is where a fresh session starts, and a fresh OpenAI setup selects openai/gpt-5.6-sol - OpenClaw models docs. The multiplayer side of 2.0 looks like this: a shared workspace with a user-built dashboard and a list of teammates who are online.

Skills ecosystems and the migration war

The skills ecosystems are harder to compare than they look. ClawHub, OpenClaw's registry, is the largest skill marketplace in the agent world: its June security dataset covered 67,453 public skill versions - OpenClaw. Every published skill passes through ClawScan, where a Codex agent weighs three independent scanners (static analysis, VirusTotal and NVIDIA's SkillSpector), and only 468 skills, 0.69%, were flagged by all three. Hermes's Skills Hub is an aggregator. Its live catalog lists 90,700 skills, of which 69,150 come from ClawHub, 19,967 from skills.sh, and only 199 are native to Hermes - Hermes Skills Hub catalog.

That last figure is the most revealing number in the ecosystem comparison. Hermes's bigger skill count is mostly OpenClaw's ecosystem, indexed and searchable from inside Hermes. That is a strength for a Hermes user, who gets the largest marketplace without running OpenClaw. It is also a shared risk: a malicious skill that slips past ClawScan is one install away for users of both agents, and Hermes's own optional pre-install scan from NVIDIA is "advisory only," printing findings without blocking the install - Hermes skills docs.

Both projects have also built tools to take the other's users. hermes claw migrate imports an OpenClaw setup, including SOUL.md, memories, skills, command allowlists, messaging settings and, with an explicit flag, API keys - Hermes migration guide. OpenClaw answered with openclaw migrate hermes, which imports model config, MCP servers, memory, skills and supported credentials from a Hermes home directory - OpenClaw migration guide. The 2.0 onboarding even lists Hermes by name among the setups it can import. Two projects that write importers for each other have stopped pretending to be complementary.

Why this matters: reach compounds differently from depth. Every channel and device node OpenClaw adds makes the Gateway more valuable to a team, and every registry Hermes indexes makes a single agent more capable, but neither makes the other's core stronger. How to apply this: if the people you need to reach are on a phone app, iMessage or a shared team workspace, OpenClaw's native surfaces are ahead. If your "team" is you plus a few specialized agents, Hermes Desktop and Bot Mode cover more of your day with less to host. And because migration now runs both ways, the cost of picking wrong has dropped: you can move your memory and skills in an afternoon. For the wider market of agents in this category, our top OpenClaw alternatives ranking is the companion piece to this section.

8. Security: The Full Record, and What It Means

The security record is the section most readers will jump to, so it deserves the most care, because the headline numbers mislead in both directions. OpenClaw has a long, public, well-documented vulnerability history. Hermes has a shorter public history and a very different way of disclosing it. The first fact says as much about scrutiny and disclosure culture as about code quality; the second says as much about policy as about safety. What follows is the record for each, then the reasoning.

OpenClaw's record

OpenClaw's problems started within days of going viral. By January 31, Censys had found 21,639 publicly exposed OpenClaw instances, up from about 1,000 less than a week earlier, with at least 30% on Alibaba Cloud - Censys. The same week brought CVE-2026-25253, rated 8.8, in which the Control UI took a Gateway address from a link and connected to it automatically, leaking the Gateway token and enabling one-click remote code execution; it was fixed in version 2026.1.29 on January 30 - The Hacker News. Then Koi Security audited 2,857 ClawHub skills and found 341 malicious ones, 335 of them in a single campaign, ClawHavoc, that installed the Atomic macOS Stealer - The Hacker News. A later count by Antiy CERT put the campaign at 1,184 malicious skills - CyberPress.

The institutional response was blunt. On February 19, Microsoft's Defender researchers wrote that OpenClaw "should be treated as untrusted code execution with persistent credentials" and that it "is not appropriate to run on a standard personal or enterprise workstation" - Microsoft Security Blog. A separate flaw found by Oasis Security, nicknamed ClawJacked, let any website brute-force a local Gateway's password over a WebSocket because localhost connections had no rate limit; OpenClaw fixed it in under 24 hours - The Hacker News. In March, Chinese authorities moved to restrict state-run enterprises and government agencies, including the largest banks, from running OpenClaw on office computers - Slashdot, citing Bloomberg.

The critical bugs kept coming through the spring. CVE-2026-32922, rated 9.9, let a caller with only a pairing permission mint administrator tokens and run code on paired nodes; it affected versions before 2026.3.11 - NVD. In May, Cyera disclosed four flaws it named Claw Chain, including a sandbox write bypass in the OpenShell backend rated 9.6, fixed in 2026.4.22 - The Hacker News. In June, Palo Alto Networks' Unit 42 documented malicious skills that slipped past ClawHub's scanning, including one padded with 22 MB of filler to evade analysis and "agentic" fraud skills that injected affiliate links and ran a pump-and-dump scheme - Unit 42.

Today the repository lists 722 published security advisories: 14 critical, 249 high, 390 medium and 69 low, read from the GitHub API on September 11 - OpenClaw security advisories. The National Vulnerability Database holds about 585 CVE records for OpenClaw itself, most assigned by VulnCheck. The monthly pattern in the chart below is worth reading closely.

The decline from February to June is real and reflects a codebase that was hardened under fire. The zero in July and August followed by 75 in the first eleven days of September is not a sudden wave of new bugs. Advisories are published when fixes ship, and nothing shipped during the seven-week gap before 2.0, so the fixes that landed in 2.0 and the releases after it were disclosed together. That is a sign of a working disclosure process, not a failing one.

Hermes's record

Hermes has zero published security advisories in its own repository - Hermes Agent security advisories. That does not mean it has no vulnerabilities. The National Vulnerability Database lists 44 CVEs against Hermes Agent, filed through third-party authorities such as VulDB and VulnCheck rather than by Nous. The most severe, CVE-2026-82021 at 9.0, was a supply-chain flaw: the bundled MCP server catalog in versions 0.18.2 to 0.19.0 referenced a third-party upstream repository by a branch that could be changed, so anyone who compromised that repository could run code on Hermes installations - NVD. Others include a DNS-rebinding flaw in WebSocket endpoints rated 8.7 and a path traversal in the WeChat Work adapter rated 5.3.

The most instructive Hermes case is GitSpawn. In early September, Manifold Security showed that a repository's own Git configuration could make seven AI coding agents run an attacker's command outside their sandbox the moment they ran git status: Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build. OpenClaw was not on the list - The Hacker News. Manifold's write-up says of Hermes: "Six contact attempts across five channels, the private GHSA advisory was never triaged" - Manifold Security. The Hermes entry became CVE-2026-71963, rated 8.8, affecting versions 0.18.2 through 0.21.0. Once the research was public, a fix was merged within about a day and shipped in v0.21.1 on September 7 - Hermes Agent pull request #101483.

The reason Hermes has no advisories of its own is written into its security policy. It says: "The only security boundary against an adversarial LLM is the operating system. Nothing inside the agent process constitutes containment" - Hermes security policy. Bypasses of the in-process checks are out of scope and "don't receive advisories," and "Hermes Agent does not operate a bug bounty program." That is a coherent position: it tells users not to rely on the approval system as a wall and to put the agent in a container. It also means the public record undercounts problems that a project with OpenClaw's disclosure practice would have published.

The most publicized Hermes security story was not a vulnerability at all. In July, an attacker ran Hermes unattended in YOLO mode, which turns off approval prompts, against Thailand's Ministry of Finance; the agent probed for root access and reached personnel records dating back to 2012 before researchers found the operator's exposed logs - The Hacker News. The Hacker News was explicit that Hermes "is not a hacking tool, and nothing here is a flaw in it." A documented feature was used as designed by someone who wanted the guardrails off, which is an argument about what an agent should make easy, not about a bug.

Reading the two records together

OpenClaw's own documentation contains the fairest summary of the gap. Its comparison page, reviewed against both codebases on August 27, counted 647 OpenClaw advisories against none for Hermes, noted that Hermes's CVEs come through third-party authorities, and warned that advisory counts are disclosure records rather than a safety score. It also admits OpenClaw's own weak point: "Sandboxing and exec approvals are off by default. Default OpenClaw is a trusted single-operator assistant" - OpenClaw docs. The page closes with a line worth quoting: "We are not saying Hermes is worse engineering. We are saying the two projects answer to different people."

Compare what each project does well. OpenClaw has the stronger security engineering around the agent: a three-scanner gate on its skill registry, credentials the model never sees, approvals tied to an exact operation, per-session permission modes, full-time security maintainers contributed by Tencent, and a record of shipping fixes within a day. Hermes has the safer defaults inside the agent: smart approval on by default, a hardline blocklist, sensitive environment variables stripped from code the model writes, and write approval on protected instruction files. OpenClaw's weakness is that its best protections are opt-in; Hermes's weakness is that its disclosure and response process has repeatedly left researchers waiting.

And one risk is shared. Because 69,150 of the skills in Hermes's hub come from ClawHub, a malicious skill that evades ClawScan is one install away for users of either agent. Hermes's optional pre-install scan prints findings but does not block the install. The skill supply chain is the single place where the two projects' security is effectively the same system.

Why this matters: an open agent's security is a property of your deployment, not of the repository, and both projects push the hardest decisions onto you. How to apply this: the non-negotiables are the same for both. Run the agent in a dedicated virtual machine or on a separate computer, as Microsoft advises for OpenClaw, or at the very least in a container or remote backend, as Hermes's own policy advises, and never on the machine that holds your real credentials. Never expose the Gateway or any agent web interface to the internet without authentication in front of it. Install skills only from sources you would trust with a shell script, because that is what a skill is. Keep both agents on their latest release, and on Hermes, confirm you are on v0.21.1 or later because of GitSpawn. The prompt-injection mechanics behind memory poisoning are covered in our AI agent security guide, and the credential problem underneath long-lived API keys is the subject of our non-human identity article.

9. IFA 2026: What NVIDIA and Microsoft Actually Announced

The event that put both agents in the same headline happened on September 3 at IFA in Berlin, and it is worth reading the exact wording, because secondary coverage flattened it into "NVIDIA and Microsoft made both agents one-click." What actually happened was narrower, and the differences between how the two agents were described say something about each project. It also matters because it shows where the two biggest hardware and operating-system companies think personal agents should run: on your own machine, on a local model, behind an operating-system sandbox.

NVIDIA's post, "Sparks Fly: NVIDIA Accelerates Local AI at IFA 2026," opens with "At IFA 2026, NVIDIA, Microsoft and its partners are teaming up to provide faster inference and new tools that make agents easier to set up and run locally" - NVIDIA Blog. It names three agent apps getting simplified local model setup on NVIDIA GPUs: Hermes Agent, OpenClaw and Perplexity Portable Computer. For Hermes, the wording is specific: "one-click setup across RTX and DGX systems on Windows," where the agent detects the GPU, selects a model and configuration, and runs it through built-in llama.cpp, "available now on Windows, with support coming soon to Linux." For OpenClaw, NVIDIA calls it "the largest AI project on GitHub, with more than 380K stars" and says its Windows app "simplifies the process of setting up an optimized local model on any RTX GPU with at least 24GB of VRAM."

So only Hermes got the words "one-click." NVIDIA's own short video, posted the same day and embedded in its IFA post, shows what that looks like on screen. It is a one-minute official clip, and it is the clearest primary source for what shipped.

The clip shows the desktop flow NVIDIA describes: detect the GPU, pick a model, start it, and point the agent at it without editing a configuration file. On the Hermes side, the feature arrived as a managed llama.cpp runtime with a one-click desktop quickstart, merged on September 1; at merge the desktop screens sat behind a --local launch flag, and the hardware check looks at memory in general rather than only at NVIDIA cards - Hermes Agent pull request #100667. "One-click" is accurate for the flow, but it is two days old, so expect rough edges.

OpenClaw's own announcement the same day is franker about why this matters. It admits that "even technically experienced users spend more than 30 minutes wrestling with setup before they can have a working agent," and describes a new macOS installer plus managed local-model setup in the Windows app that works "on any NVIDIA RTX GPU with at least 24GB of memory, enough to run 30B-class models entirely on your own machine" - OpenClaw. The screenshot from that post shows the recommended path on Windows: install a local Gateway in an isolated Ubuntu WSL instance, detect the GPU, and download a 22.7 GB quantized Qwen model.

Notice two details in that screenshot. The Gateway runs inside WSL, the Linux layer on Windows, rather than as a native Windows process, and the model is a 35-billion-parameter open-weight model that fits on a single 24GB card. That is the shape of the whole IFA push: open models small enough for one consumer GPU, driven by an agent that previously needed a cloud API key to do anything useful.

What was new, and what was not

Much of what got attached to the IFA story had actually launched months earlier. RTX Spark, NVIDIA's Arm-based PC chip with up to a 6,144-core Blackwell GPU, a 20-core Grace CPU and up to 128 GB of unified memory, was unveiled on May 31 at Computex - NVIDIA Newsroom. Microsoft Execution Containers (MXC), the Windows sandbox for agents, shipped as an early preview at Microsoft Build on June 2, when Microsoft wrote that "OpenClaw now runs the node and gateway securely on Windows leveraging MXC" and that "Hermes Agent will be integrating OpenShell and MXC in their new Windows application" - Windows Developer Blog. OpenShell and NemoClaw, NVIDIA's sandbox runtime and one-command agent stack, date to GTC in March.

What was genuinely new at IFA was smaller and more practical. The local-model setup in both agents. A second round of inference speedups, "up to 1.9x higher throughput" for llama.cpp on a GeForce RTX 5090, measured on one 35B model against NVIDIA's own June baseline rather than against stock software. NVIDIA PAIR, a free, open-source router that spreads inference across the PCs on a home network. And a firmer date for RTX Spark PCs: October, from the six manufacturers announced in May plus new Lenovo Yoga designs and an Acer desktop concept. Microsoft's own IFA-week developer announcement, Project Zenith, launches first on AMD hardware and does not mention either agent - Windows Developer Blog.

The maturity caveats matter for anyone planning around this. MXC's own repository warns that "no MXC profiles should be treated as security boundaries currently" - Microsoft MXC on GitHub. OpenShell's repository lists Windows support only through WSL 2, marked experimental. OpenClaw lists support for RTX Spark and DGX Station on Windows as "planned." NVIDIA's PAIR demo, in which Hermes split a task across five subagents, ran about twice as fast on a three-machine cluster as on one RTX Spark laptop, and NVIDIA labels the result unofficial and specific to its configuration - NVIDIA Developer Blog. None of this is ready to be the security layer an enterprise relies on today.

Why this matters: IFA was the moment both agents became the reference software for a hardware category. NVIDIA needs agents that run all day on a local GPU to justify RTX Spark, and Microsoft needs them to justify an agent-aware Windows. Both agents benefit, and Hermes got the stronger endorsement in the wording. How to apply this: if you have an RTX card with 24GB or more today, both agents can now run a capable open model locally with little setup, which removes the per-token bill for routine work. Do not treat MXC or OpenShell on Windows as production sandboxes yet; use them as a second layer on top of a VM or a dedicated machine. If you are deciding whether to buy an RTX Spark PC in October, wait for the Linux version of Hermes's local setup and OpenClaw's promised Spark support. Our guide to running an agent on a single 24GB GPU covers the local-model side in depth, and our open-source LLM ranking covers which open models are worth running.

10. What It Costs to Run: Plans, Tokens, and Subscriptions

Both agents are free, MIT-licensed software, and both will cost you money every month, because an agent turns tokens into work and tokens are metered. The bill has three parts: where the agent runs, which model it calls, and how often it wakes up when nobody asked it anything. The two projects differ on all three, and 2026 added a fourth line that nobody planned for: whether the model vendors let you pay with a flat subscription at all.

Start with what each project sells, because the difference is structural. OpenClaw sells nothing. Its homepage puts it plainly: "No subscription. No hosted tier. No token" - OpenClaw. Every "OpenClaw Cloud" plan you see advertised is a third-party host. Nous Research, by contrast, built a business around Hermes. Nous Portal is one subscription that bundles access to more than 300 models with a Tool Gateway for web search, scraping, image generation, browser automation and speech, each billed per use from the same credit balance - Nous Portal.

Nous Portal plans - Nous Portal:

Every paid tier includes 10% more credit than it costs, and the Portal's model prices sit below list for most frontier models: it lists Claude Fable 5.1 at $8 input and $40 output per million tokens, against Anthropic's list price of $10 and $50 - Anthropic pricing. Nous also runs Hermes Cloud, an always-on hosted Hermes that needs $2 of credit or an active subscription to deploy, and charges $0.56 a day for a Medium instance while it runs and $0.03 a day while it is stopped, with model and tool usage billed on top - Hermes Cloud. Run all month, a Medium instance works out to about $16.80 before tokens. One detail from Nous's own docs is telling: its open Hermes 4 models are cheap on the Portal but "not recommended for use inside Hermes Agent," because they were tuned for chat rather than tool use - Hermes Agent docs.

The subscription wars

OpenClaw's cost story is really a story about other companies' subscriptions. OpenClaw lets you reuse a ChatGPT or Claude login instead of paying per token, and both vendors have changed the terms this year. On April 4, Anthropic stopped Claude Pro and Max subscribers from using their plan limits in third-party tools, starting with OpenClaw; the head of Claude Code said "Anthropic's subscriptions weren't built for the usage patterns of these third-party tools" - The Next Web. In May, Anthropic announced separate monthly Agent SDK credits as a way back, then paused the plan on June 15; today, third-party app usage simply draws from the subscription's normal limits, and the announced credit "isn't available" - Claude Help Center. Those limits shrink again on September 14, when Anthropic's change works out to about 17% less weekly Claude Code usage than today - BleepingComputer.

OpenAI went the other way. On May 2, Sam Altman posted that "you can sign in to openclaw with your chatgpt account now and use your subscription there" - The Next Web. OpenClaw's docs confirm that OpenAI "explicitly supports subscription OAuth usage in external tools and workflows like OpenClaw" - OpenClaw OpenAI provider docs. The catch arrived on August 25, when OpenAI restored a rolling five-hour usage cap for ChatGPT Plus subscribers using Codex, which is the route OpenClaw uses - 9to5Mac. The net effect: an OpenClaw user's cheapest frontier path runs through OpenAI, the company that also employs OpenClaw's creator and donates to its foundation, and even that path is now metered by the hour.

What the models cost

For everyone paying per token, the model you route to dominates the bill, and the spread is enormous. The chart below shows live OpenRouter list prices for output tokens on September 11, for models both agents can call.

That is a 125x spread between the top and bottom bars, and GPT-6 Astra charges more again for prompts over 272,000 tokens, at $20 input and $75 output per million - OpenAI model docs. To make it concrete, take one illustrative workload: an agent that reads 2 million tokens and writes 200,000 a day, every day for a month, or 60 million in and 6 million out. At list prices and before caching, that costs about $900 on Claude Fable 5.1, $720 on Fable 5.1 through Nous Portal, $450 on Claude Opus 5, $67.50 on Gemini 3.8 Flash and about $25 on DeepSeek V4.1 Flash, and nothing in tokens on a local model. Prompt caching changes the picture a lot for agents, which resend the same context every turn: Fable 5.1 charges $0.25 per million for cached input, a fortieth of its list input price.

The extreme case belongs to OpenClaw's creator. In May, Peter Steinberger posted an OpenAI bill of $1,305,088.81 for one month, covering 603 billion tokens across 7.6 million requests from about 100 Codex agents run by a team of three working on OpenClaw itself; OpenAI, his employer, paid it, and he said turning off Codex's fast mode alone would have cut the raw cost to about $300,000 - Tom's Hardware. It is not a typical bill. It is a useful upper bound on what unattended agents can spend when nobody sets limits.

Be careful with third-party cost guides, because many are written by companies that sell hosting. Hostinger, which sells a managed Hermes plan at $5.99 a month rising to $11.99 at renewal, puts self-hosted Hermes at $6 to $85 or more per month - Hostinger. A widely quoted figure of $535 a month for self-hosting Hermes traces back to an unaffiliated fan site, and $455 of it is imputed labor, 3.5 hours a week at about $30 an hour, not cash - hermes-agent.ai. The labor point is still worth taking seriously. For both agents, the free software is the cheapest line on the invoice, and your own time maintaining it is often the most expensive.

Why this matters: cost is a design property before it is a billing property. Hermes was built to hibernate on serverless backends and to sell you a subscription that includes the tools an agent needs; OpenClaw was built to be always on and to borrow whatever subscription you already had, which worked until the vendors started metering it. How to apply this: on Hermes, start on the $20 Plus plan or a local model, and watch the credit meter for a month before upgrading. On OpenClaw, set a cheap model for routine and background work, keep the expensive model for tasks that need it, and set spending limits on any API key the agent holds. On both, turn on prompt caching and a local model for anything routine. Our cheapest LLM APIs price table tracks the budget tier, our best LLM for agents ranking covers which expensive models earn their price, and our GPT-6 Astra pricing breakdown covers the new repricing threshold in detail.

11. Setting Up Each One Safely

Both projects install with one command and both start with a guided setup, and that is where the resemblance ends, because the defaults each leaves you with differ in exactly the ways Section 5 described. This section walks through both installs, then the hardening steps the defaults skip. Nothing here requires more than copying a line into a terminal, but every line is worth reading before you run it: both installers pipe a script from the internet into your shell, which is exactly the pattern both projects' own security scanners flag in skills.

OpenClaw needs Node 24.16 or later (or 26.1 or later), and the installer sets Node up if it is missing - OpenClaw install docs. The guided setup now starts from what is already on your machine, finds existing ChatGPT, Codex or Claude sign-ins, API keys and local models, and checks that the chosen model actually answers before saving it. The Gateway then listens on port 18789 on your own machine only.

Install OpenClaw:

# macOS, Linux or WSL2
curl -fsSL https://openclaw.ai/install.sh | bash

# Windows PowerShell
iwr -useb https://openclaw.ai/install.ps1 | iex

# Or through npm (npm 12 or 11.16+; drop the flag on older npm)
npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon

Three OpenClaw settings deserve a decision on day one. First, turn on approval for commands on the host: the default runs them without asking, and the docs recommend openclaw config set tools.exec.mode auto. Second, keep DM pairing on, and approve each new sender with openclaw pairing approve <channel> <code>; codes expire after an hour. Third, turn on sandboxing for anything that is not your own main session, and run openclaw security audit to check for configuration drift - OpenClaw security docs. The sandbox settings live in ~/.openclaw/openclaw.json:

{
  agents: {
    defaults: {
      sandbox: {
        mode: "non-main",        // off (default) | non-main | all
        scope: "session",        // agent (default) | session | shared
        workspaceAccess: "none", // none | ro | rw
        backend: "docker",       // docker | podman | ssh | openshell
        docker: {
          network: "none",
          readOnlyRoot: true,
          capDrop: ["ALL"]
        }
      }
    }
  }
}

The non-main mode sandboxes every session except your own main one, and group or channel sessions always count as non-main, so messages from other people run in a container - OpenClaw sandboxing docs. Choosing session scope gives each conversation its own container instead of one per agent. Note that only the Docker backend supports OpenClaw's sandboxed browser. Our OpenClaw setup guide walks through ten configurations by use case.

Hermes needs only Git; its installer provisions Python 3.11, Node and the other tools it needs, and native Windows, macOS on Apple Silicon, Linux and WSL2 are the fully supported platforms - Hermes installation docs. People who never want a terminal can use the Hermes Desktop installer instead. Hermes also requires a model with at least 64,000 tokens of context and refuses smaller ones at startup.

Install Hermes Agent:

# Linux, macOS, WSL2 or Android (Termux)
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

# Windows PowerShell
iex (irm https://hermes-agent.nousresearch.com/install.ps1)

# Sign in to Nous Portal, set it as the provider, and turn on the Tool Gateway
hermes setup --portal

# Coming from OpenClaw? Preview the import before running it for real
hermes claw migrate --dry-run

The Hermes decisions that matter are the execution backend, the approval mode and the write gates. For anything that runs unattended, move execution off your own machine. For the first month, make the agent ask before it changes its own memory or skills. These settings live in ~/.hermes/config.yaml:

approvals:
  mode: manual               # smart (default) | manual | off
memory:
  write_approval: true       # stage memory edits for review
skills:
  write_approval: true       # stage skill changes for review
terminal:
  backend: docker            # local (default) | docker | ssh | modal | daytona | vercel_sandbox | singularity
  docker_network: false      # network is on by default; false cuts it off
  container_persistent: false  # a fresh container per session instead of one shared container

Each of those lines changes a default. Manual approval shows you every risky command the agent wants to run, which teaches you what it actually does; later, hermes approvals suggest reads your approval history and proposes an allowlist that never includes destructive commands - Hermes security docs. The write gates stage memory and skill changes so you can review them with /memory pending and /skills pending. By default the Docker backend runs one long-lived container shared across all your sessions; container_persistent: false gives each conversation its own, which matters if one conversation might read something hostile - Hermes configuration docs.

Why this matters: both guided setups optimize for a working agent in five minutes, and a working agent in five minutes is one that runs on your laptop with your keys. The hardening above takes about twenty more minutes and changes the blast radius from "your machine" to "a container you can delete." How to apply this: do the container step before the first real task on either project, keep OpenClaw's pairing and Hermes's approval gates on, and treat the first month as a period in which the agent earns trust rather than one in which it already has it.

12. Governance: Foundation vs Venture-Backed Lab

An open agent you depend on is a bet that someone will still maintain it in two years, and the two projects offer very different counterparties. OpenClaw is stewarded by the OpenClaw Foundation, announced on July 8 as a US 501(c)(3) non-profit whose stated job is to keep OpenClaw MIT-licensed and independent - OpenClaw. Its donors page names Offline Holdings, the University of Michigan, OpenAI, Microsoft and NVIDIA, plus 329 GitHub sponsors - OpenClaw Foundation. The University of Michigan is the largest donor, core maintainers come from NVIDIA, Microsoft, OpenAI, Tencent, Atlassian, Red Hat, Hugging Face and Xiaomi, and more than 3,324 people have shipped code into the project.

The foundation's structure has a visible tension. Peter Steinberger joined OpenAI in February, where he leads a team called Claw Labs, and the foundation's own launch post says: "Peter built this thing, and Peter keeps making the calls, especially the technical ones" - OpenClaw. Dave Morin is listed as chairperson, but no board of directors is published - OpenClaw Foundation. The foundation positions OpenClaw as "the Switzerland of AI," neutral ground for every model and lab - InfoWorld. Neutrality is harder to guarantee when the founder works for the largest model vendor among the sponsors, and when that vendor is also the one whose subscription OpenClaw users are steered toward.

Hermes is owned outright by Nous Research, founded in 2023 by Jeffrey Quesnelle, Karan Malhotra, Ryan Teknium and Shivani Mitra. It had raised $70 million, and in July TechCrunch reported it was finalizing at least $75 million more at a $1.5 billion valuation, led by Robot Ventures with USV participating - TechCrunch. Nous declined to comment, and no closing has been confirmed since. A venture-backed lab with a model business is a different kind of durable: its agent is the front door to its subscription and a source of training data for its models, so it has commercial reasons to keep the agent alive regardless of GitHub stars.

The clearest governance difference is throughput, and the GitHub numbers read on September 11 tell it better than any statement.

OpenClaw has merged 37,593 pull requests and has 2,437 open. Hermes has merged 13,241 and has 27,883 open, more than twice as many waiting as have ever landed. The two repositories have almost the same number of distinct contributor identities, about 3,400 each, so the difference is not the size of the community; it is how much of what the community sends gets reviewed. Some of the Hermes backlog is a feature of how it works: maintainers often close a pull request and rework the idea themselves, which is why it has 39,091 closed without merge. And its release notes show how concentrated review is. Of the roughly 2,475 pull requests merged for Pantheon, @teknium1 is credited with about 1,340, more than half - Hermes Agent releases.

The other governance test is behavior under criticism. When ClawHub was found to be full of malware, OpenClaw added VirusTotal scanning for every skill within days, re-scans all active skills daily, and in June added a three-scanner gate with NVIDIA - OpenClaw. When a Chinese project called EvoMap alleged in April that Hermes had copied its self-evolution engine, Nous co-founder Teknium said he had "literally never heard of this person, their project, or anything they are doing," and EvoMap switched its license from MIT to GPLv3 - Yicai Global. On GitHub, the issue raising the claim was later renamed to a single period, four users were blocked and four comments deleted - GitHub issue #10232 timeline. This guide takes no position on the underlying claim, which has not been tested anywhere formal. The handling, together with the unanswered GitSpawn reports in Section 8, is the kind of thing an enterprise buyer notices.

Why this matters: the question is not which structure is better in the abstract but which failure you can plan around. A foundation can stall if its sponsors' interests diverge, and OpenClaw's most influential sponsor is also the vendor its cheapest usage path runs through. A venture-backed lab can pivot if the agent stops serving the model business, and Hermes's backlog suggests the lab already cannot review what the community sends. How to apply this: if you build on OpenClaw, use the Extended Stable line for anything critical and watch for a published board and governance charter. If you build on Hermes, watch the open pull request count and whether researchers' reports get answered; a backlog that keeps growing while disclosures go unanswered is the leading indicator of trouble. For how the same sustainability question played out in the generation of agent frameworks before these two, see our LangGraph vs CrewAI vs AutoGen comparison.

13. The Rest of the Field, and Where Both Fall Short

Hermes and OpenClaw are the two biggest open agents, but they are not the only way to get an agent that acts for you, and the alternatives matter because they define what each open project competes against. The field splits into three groups: the hardware vendor that decided to back both, the frontier labs and platforms selling their own agents, and managed platforms that sell the outcome rather than the software.

NVIDIA is the most interesting third party because it refused to pick. At GTC in March it launched NemoClaw, a one-command stack that installs open Nemotron models and the OpenShell sandbox runtime, with Jensen Huang saying "OpenClaw is the operating system for personal AI" - NVIDIA Newsroom. By June, NemoClaw could run Hermes too, and NVIDIA's developer blog published a design for running Hermes inside an OpenShell sandbox with credentials injected at the boundary rather than handed to the agent - NVIDIA Developer Blog. The architecture figure from that post is below.

The point of the figure is where the trust boundary sits. The agent, its skills and its tools are all inside the sandbox, and anything that leaves goes through a proxy on the host that decides what is allowed. That answers the security section's main complaint about both projects, because it moves the boundary out of the agent's own process, which is exactly what Hermes's security policy says is the only real boundary. NemoClaw's repository now lists OpenClaw as the default agent and Hermes as a supported one - NVIDIA NemoClaw on GitHub. If you have a capable NVIDIA GPU, evaluating either agent inside NemoClaw rather than bare is the fairer comparison.

The second group is the labs and platforms with their own agents. Claude Code and Codex are coding agents first, and GitSpawn showed they share many of the same risks as the open agents. xAI opened its Grok Bot agent to enterprises on September 3, adding access, network and audit controls - xAI. Salesforce and Anthropic announced a Salesforce plugin for Claude in August, expected to enter open beta this month - Salesforce. These products sell the governance that the open agents leave to you: audit trails, admin controls, a vendor to call. Our Grok Bot pricing analysis and our Claude Code vs Codex vs Cursor comparison cover them on their own terms.

The third group is managed platforms, and they exist because of the operator-time problem from Section 10. Both open agents assume you will host, patch, harden and supervise them. Platforms like o-mega sit at the other end of that trade: instead of installing and teaching one agent, you describe a business and the platform builds and operates it, website, app, billing, content and admin included, with hosting, sandboxing and credentials handled on the platform's side. The trade-off is the same for every managed option: you give up the local-first control and model freedom that make Hermes and OpenClaw attractive, in exchange for not owning the security section of this guide yourself. Our OpenClaw alternatives for business ranking compares the managed options against each other.

Where do both open agents fall short? In two places, and they are the same two for both. Neither is a boundary between people who do not trust each other: OpenClaw's docs say it "is not a hostile multi-tenant security boundary," and its September 5 release warned that on shared Gateways, default settings now let agents read other users' transcripts - OpenClaw release notes. And neither has an answer for the person who does not want to operate an agent at all, which is most people, and which is why the managed layer keeps growing while the two open projects compete for enthusiasts.

Why this matters: the open agents compete for one slice of the market, the people who want control and will pay for it in time. How to apply this: if you are that person, the rest of this guide applies. If you are not sure, run one of the two inside NemoClaw or a disposable VM for a month to learn what an agent can do for you, and then decide whether the control is worth the operating. For the broader set of agents that act on your behalf, our open-source personal AI guide covers the projects that did not become Hermes or OpenClaw.

14. Use Cases: Who Should Pick Which

The scorecard in Section 1 gives one number, and every section since has shown why that number is close. This section turns the evidence into decisions by the job you want done rather than by feature. The pattern is consistent: OpenClaw wins wherever the agent touches more than one person, device or channel at once, and Hermes wins wherever one person wants an agent that gets better at their recurring work.

The solo operator with recurring work is Hermes's home ground, and it is a bigger group than it sounds: the freelancer who writes the same client report every Monday, the researcher who runs the same literature sweep every week, the person whose backups and audits run overnight. Hermes's cron jobs now carry memory between runs, the skills it writes after the first painful run make the second one cheaper, and Bot Mode lets you split recurring work across named specialist agents. Run it on a serverless backend or Hermes Cloud, connect it to the chat app you already use, and the total cost is a Portal plan plus a few dollars of hosting.

The team with shared work is OpenClaw's, and 2.0 was built for it. Shared cloud sessions keep context when a colleague joins, the durable record stays on the Gateway rather than on someone's laptop, and standing approvals let one person grant an automation a precise permission that another can inspect or revoke. Steinberger's own description of how the team builds OpenClaw now is the use case in one line: "Multiplayer coding + infinite compute with nodes and cloud sessions has been a game changer for how we build" - InfoQ. The price is the Gateway, which must be hosted, hardened and, for a distributed team, reached through a private network rather than the open internet.

The security-conscious buyer is the hardest case, because both projects fail the question as shipped and can pass it as configured. Microsoft's advice for OpenClaw, a dedicated VM with non-privileged credentials and non-sensitive data, applies to Hermes unchanged. Inside that VM, OpenClaw's controls give an auditor more to point at: permission modes, exact-operation approvals, credentials the model never sees, and a published advisory record. Hermes gives a smaller surface and safer defaults, but a disclosure process that has left researchers waiting. A buyer who must show an auditor controls should lean OpenClaw; either way, run it inside NemoClaw or an equivalent sandbox.

The builder who wants agents that manage agents is a fourth group that both projects now serve from opposite ends. Hermes's hermes peer and Bot Mode let named agents message each other across machines, and its subagent steering lets a parent redirect its children mid-task, ten at a time by default. OpenClaw's cloud workers turn spare machines into session capacity and its multi-agent routing binds agents to channels. Neither yet has the orchestration depth of a purpose-built multi-agent framework. Our Claude Code subagents guide shows what a mature parallel-agent setup looks like, which is the bar both are chasing.

Why this matters: a "which is better" answer that ignores the job is a coin flip dressed up as analysis, and the jobs sort cleanly. How to apply this: answer the first question in the diagram honestly. If the agent will act for more than one person, the Gateway model scales and OpenClaw is its mature implementation. If it will act for you alone and you want it to compound, Hermes is the only one of the two that learns by default. Our top OpenClaw use cases ranking tracks which workflows survived contact with real users, and most of them map onto one branch of the diagram or the other.

15. The Road Ahead

The most reliable prediction about these two projects is that they will keep copying each other, because the last six months show little else. Hermes launched as a single learning agent and now has bot societies, peer messaging and an MCP command center. OpenClaw launched as a personal gateway and, as of this week, drafts its own skill proposals, turns past conversations into reusable skills, and consolidates memory in the background. Each release narrows the gap the marketing describes. The reasonable expectation for 2027 is that OpenClaw will learn more by default behind approval gates, Hermes will grow a real team story, and the choice will turn on governance, cost and defaults rather than architecture.

The second force is the model vendors, who have learned that open agents are both their best distribution and their most expensive users. Anthropic's April cutoff and paused credit plan showed that a flat-rate subscription cannot subsidize an agent that runs all day; OpenAI's decision to let ChatGPT subscribers use OpenClaw, followed by the return of a five-hour cap in August, showed that even a willing vendor will meter it. Expect metered credits for programmatic use everywhere, with open agents pushed toward whichever lab wants their traffic. The consolidation of the open-model layer points the same way: Stripe agreed to acquire OpenRouter in August, reportedly for about $7.5 billion - CNBC, and NVIDIA agreed on September 3 to buy Hugging Face for $12.93 billion - TechCrunch. The gateway that measures Hermes's lead and the hub that hosts the open models both agents run locally now belong to much larger companies.

The third force is the hardware layer. NVIDIA's bet is that a personal agent belongs on a local GPU behind an operating-system sandbox, with the cloud reserved for the hardest calls, and both agents have become the reference software for that bet. If it lands, the agent that runs best on a 35-billion-parameter open model on one consumer card wins the mass market. Nous, which trains models and built its agent to generate their training data, is structurally closer to that outcome; OpenClaw has the larger install base to bring along. If frontier models keep pulling away on the tasks people actually delegate, the agent with the best subscription plumbing wins, and today that is OpenClaw with OpenAI behind it.

The fourth force will decide whether either project is still the reference in 2028: security at scale. OpenClaw's 2026 was a rolling crisis it survived because its responses were fast and its sponsors patient. Hermes has not had its ClawHavoc, but three-quarters of its skill hub is ClawHub, and its handling of GitSpawn showed a disclosure process that did not respond until a report went public. How Nous handles its first major supply-chain incident is the open question behind its governance score. Our self-improving agents guide covers the research behind the learning loop both projects are racing toward.

Why this matters: a comparison written in September 2026 is a snapshot of two moving targets, and the direction of movement is more useful than the position. How to apply this: pick the project whose trajectory matches your need rather than the one whose feature list does today. If you need team features, OpenClaw has them and is deepening them. If you need an agent that learns, Hermes has it now and OpenClaw's version is only days old. Whichever you pick, plan for the day it becomes the target of the kind of campaign the other has already been through.

16. Conclusion: The Decision Framework

On the standard weights in Section 1, OpenClaw edges Hermes by one twentieth of a point, and that margin is the finding. Two projects with opposite architectures have arrived at comparable value, and what separates them is who the agent is for, what it costs to keep safe, and who you are trusting to maintain it. OpenClaw is the mature control plane: the broadest reach, the strongest team features, the most corporate backing, the most disciplined release process, and the longest vulnerability history of any open agent, which its 2.0 design was built to end but whose defaults still leave the protections off. Hermes is the only one of the two that learns by default, the cheapest to run, the clear leader among people paying per token, and the one NVIDIA called one-click, governed by a fast-moving company whose review backlog and disclosure record are the reasons to hesitate.

The decision comes down to four questions, and none of them is about features. First, who does the agent act for: more than one person points to OpenClaw, one person points to Hermes. Second, how much operating will you do: both need a container and a hardening pass, OpenClaw also needs a hosted Gateway, and neither is something you install and forget. Third, which failure can you absorb: a control plane reached by the wrong person, which is OpenClaw's history, or a learning loop taught the wrong lesson, which is Hermes's built-in risk. Fourth, who do you want as a counterparty: a foundation whose founder works at its biggest model-vendor sponsor, or a venture-backed lab with a subscription to sell and a merge queue it cannot clear.

If those questions do not separate the two for you, the practical answer is cheap: install both inside a disposable VM or NemoClaw, connect them to the same chat app, give them the same recurring tasks for a month, and keep the one that is still running and still useful on day thirty. Migration now runs both ways, so the choice is reversible in an afternoon. That, more than any score, is the state of open agents in September 2026: two projects good enough to argue about, changing too fast for the argument to settle, and both worth the afternoon it takes to try.

This guide reflects the open agent landscape as of September 11, 2026. GitHub statistics, OpenRouter rankings, model prices, subscription terms and security disclosures for both projects change weekly, so verify current details before deploying either agent with real credentials.