Hermes Agent vs OpenClaw: what the source says about defaults and security

This Hermes Agent vs OpenClaw comparison sticks to what can be checked in each project's own repository at a pinned commit: where commands run when you change nothing, what asks you before acting, what each project says its security actually rests on, where memory is kept, and how much security history each has published. We haven't run either agent on real errands, so nothing here says which one completes tasks better. The two longer source reviews behind this page are Hermes Agent and OpenClaw security.

• Out of the box both run commands on the machine hosting the agent. Hermes defaults to its local terminal backend; OpenClaw's sandbox mode falls back to off.
• Hermes asks an auxiliary model to triage dangerous shell commands by default (smart mode). OpenClaw's host exec fallbacks are security=full and ask=off, so ordinary commands don't prompt unless you configure them to.
• Hermes's security policy says the operating system is the only real boundary and that its own approval gate is a heuristic. OpenClaw's guidance assumes one trusted operator per gateway and tells mixed-trust users to run separate gateways.
• OpenClaw had 722 published GitHub security advisories on 19 October 2026; Hermes had none published there. That count measures disclosure practice as much as bugs.

Hermes Agent vs OpenClaw at a glance

The table compresses the sections below. Each cell is linked in the section that explains it.

Both projects are large and busy. On 19 October the OpenClaw repository had about 392,000 GitHub stars and Hermes Agent about 255,000. GitHub's compare view counts more than 10,000 commits on each default branch between 19 September and 19 October, which is the cap that view reports, so the true number for each is higher. OpenClaw releases; Hermes Agent releases.

Where Hermes Agent and OpenClaw run commands by default

Neither project isolates shell commands unless you set it up. That is the single most useful fact to carry into either installation.

Hermes Agent's example configuration sets terminal.backend: "local", and the terminal implementation falls back to local execution. Commands then run as your user on the machine hosting Hermes. Docker, SSH, Singularity, Modal and Daytona are documented alternatives you switch to. Terminal defaults at the current commit; Backend fallback in our review.

OpenClaw's sandbox resolver takes the agent's setting first, then the shared setting, and falls back to mode off, backend docker and workspace access none. A Docker backend is named but not switched on. With no active sandbox, an implicit host=auto runs on the gateway host, while an explicit host=sandbox refuses to run at all. Sandbox fallbacks at the current commit; Host selection in our review.

When you do turn isolation on, the two confine different things. Hermes is explicit that a non-default terminal backend confines shell and file-tool operations only; its code-execution tool, MCP subprocesses, plugins, hooks and skill loading still run in or from the agent's own process. To confine those, Hermes documents wrapping the whole process, either in its own Docker image or in NVIDIA OpenShell. OpenClaw's Docker sandbox defaults to network none and drops all capabilities, and what host data it sees depends on workspace access and bind mounts. We read these as configuration; we didn't test containment on either. Hermes on what a backend does not confine; OpenClaw Docker defaults.

Hermes Agent vs OpenClaw approval defaults

The approval systems differ more in their defaults than in what they can be configured to do.

Hermes Agent's documented default is approvals.mode: smart. An auxiliary model looks at a dangerous shell command, approves low-risk cases for that one command, denies clearly dangerous ones and sends uncertain ones to you. manual always asks; off bypasses approvals, as do the --yolo flag and HERMES_YOLO_MODE. If nobody answers a prompt within 300 seconds, the command is denied. Cron jobs, one-shot hermes chat -q sessions and unattended webhook or API sessions each default to deny when they hit a prompt nobody can answer. Approval settings and defaults; Timeout behaviour.

OpenClaw's host exec fallbacks are security=full, ask=off and askFallback=deny, unchanged between the commit we reviewed on 12 October and the current one. full means a command doesn't need to match an allowlist, and ask=off means ordinary policy prompts are off. askFallback=deny only matters once a prompt is required and nobody can answer it, so it does not turn the default into ask-first. Newer configuration uses tools.exec.mode with deny, allowlist, ask, auto and full. Exec fallbacks at the current commit; What full, off and deny mean.

So with no configuration, Hermes puts a model-based check in front of commands it classes as dangerous, and OpenClaw lets ordinary host commands through. Both can be moved to either end. These findings cover shell execution; neither review establishes a universal gate on sending, buying or deleting across every integration.

How Hermes vs OpenClaw describe their own security model

Both projects publish a threat model, and they place the line in different spots.

Hermes Agent's security policy calls it a single-tenant personal agent and states that "the only security boundary against an adversarial LLM is the operating system." The approval gate, output redaction, pattern scanners and tool allowlists are all described as heuristics working on text an attacker can influence. Running the default local backend while reading the open web, inbound email or untrusted MCP servers is described as outside the supported posture. Reports that only defeat one of those heuristics are closed as out of scope for the private security channel. Trust model and the OS boundary; Supported posture.

OpenClaw's guidance assumes a single trusted operator per gateway, or a team whose members trust each other. For mixed-trust users it advises separate gateways and credentials, ideally on separate OS users or hosts, and it treats a paired node as extending the operator's reach to another machine. Its README also offers the gateway as a shared team deployment, so the trust-boundary pages are the ones to read before doing that. It ships a openclaw security audit command for checking a configuration. One trust boundary per gateway; Team deployment in the README.

Hermes Agent and OpenClaw credentials and memory

Hermes keeps secrets in ~/.hermes/.env and settings in ~/.hermes/config.yaml. Its policy says provider API keys and gateway tokens are stripped from the environment handed to shell subprocesses, MCP subprocesses, cron scripts and the code-execution child, unless you or a loaded skill declare a variable. It then says plainly that this is not containment: skills, plugins and hooks run inside the agent process and can read whatever the agent can, including credentials in memory. Credential scoping.

For OpenClaw, our review covers the project's prompt-injection advice to keep secrets outside the agent's reachable filesystem and to sandbox sensitive execution. We didn't trace how OpenClaw stores or passes provider keys, so we can't put a like-for-like line next to Hermes's here. Prompt-injection guidance.

Memory is plain Markdown in both. Hermes writes MEMORY.md and USER.md under the active profile, and the memory snapshot in the system prompt is taken at session start, so a fact saved mid-conversation shows up in the next session, or sooner if context compression or /undo rebuilds the prompt (details). OpenClaw promotes records into a workspace MEMORY.md and keeps a SQLite-backed index beside it. In both cases deleting the Markdown file isn't proof that every copy is gone. Hermes memory checks; OpenClaw memory stores.

Hermes vs OpenClaw channels and where you talk to them

OpenClaw's README lists Discord, iMessage, Slack, Teams, Telegram, WhatsApp "and 20+ more", plus native apps for macOS, iOS, Android, Windows and Linux. Hermes Agent's README lists Telegram, Discord, Slack, WhatsApp, Signal and email through one gateway process, a terminal UI, and an Electron desktop app. Both run the messaging side as a gateway you host. OpenClaw channels; Hermes channels.

We didn't connect either to a messaging account, so we can't say how each behaves in a group chat or with untrusted senders. OpenClaw's own guidance is the clearer of the two on that point: channel access controls decide who can talk to the bot, and they don't remove hostile text from a document an allowed user forwards.

OpenClaw vs Hermes Agent security advisories and maintenance

On 19 October 2026 OpenClaw had 722 published advisories in GitHub's security advisory database for its repository: 14 critical, 249 high, 390 medium and 69 low. Most were published in February and March 2026, while search interest in OpenClaw was at its peak. Hermes Agent had none published there. Its policy takes reports through GitHub's private advisory form or a security email address and says it runs no bug bounty. OpenClaw advisories; Hermes Agent advisories; Hermes reporting policy.

Read those two numbers carefully. A long advisory list shows that a project receives reports and publishes them; it doesn't show that the software is less safe than one with an empty list. Hermes also defines a narrower scope for what counts as a vulnerability, since bypassing one of its in-process heuristics is out of scope by design. The fair conclusion is that OpenClaw's security history is public and long, and Hermes's isn't visible in the same place.

Both ship often. OpenClaw published four stable releases and three betas between 13 and 18 October; Hermes went from v0.21.6 on 8 October to v0.22.2 on 15 October. At that pace a default can change between our reading and yours, which is why every claim above links a commit rather than a branch.

Choosing between Hermes Agent and OpenClaw

We don't rank them, and nothing we've measured would justify it. What the source does tell you is what to check first, depending on your worry.

If you're worried about destructive shell commands on your own laptop, both need a sandbox you configure. With Hermes, pick a non-default terminal backend or wrap the whole process; with OpenClaw, set sandbox mode and confirm with openclaw exec-policy show. If you'd rather have a prompt before risky commands with no setup, Hermes's smart default is closer to that, with the caveat its own policy gives: a model's judgment isn't a boundary. If you plan to share one agent among several people, OpenClaw documents that case and tells you to split gateways when people don't fully trust each other; Hermes describes itself as single-tenant.

Most comparisons in search results frame the choice as Hermes's learning loop against OpenClaw's reach. The source supports a narrower version of that. Hermes's skills are Markdown procedures stored under ~/.hermes/skills/ and loaded when needed, alongside a tool registry; OpenClaw builds its tool set per agent from configuration and plugins, and its channel list is the longer of the two. Whether Hermes's skills actually make it better at your tasks over time is something only running it would show, and we haven't. Hermes skills; OpenClaw tool construction.

For other open-source agents on the same axes, use the 15-agent comparison table; ZeroClaw is a Rust reimplementation built from OpenClaw's code. For how we score the closed products we've tested, see how we take them apart.

How this Hermes Agent vs OpenClaw comparison was made

Every finding comes from static reading of the two public repositories. The longer reviews used REA (morluto/rea, MIT, v6.4.0) plus manual reading at 0b89435e7e4f7fab88a34eb69f13bf339eb2fd00 for Hermes Agent and e46cb104f29782ab08caee36607946074f91056f for OpenClaw, both read on 12 October 2026. For this page we re-read the defaults and security documents at 5fc490e2b34123212d73ef316086f939567a725a (Hermes) and 4278e94e48b2fb2e91d09416759e0c4f04ad2b61 (OpenClaw), the heads of each default branch on 19 October. Stars, releases, commit counts and advisory counts come from the GitHub API on the same day. Neither agent was executed and no traffic was captured.

Personal Agent Bench is run by the Zentor team, which builds agent software. We aren't affiliated with Nous Research or the OpenClaw project, and Zentor's products don't appear in this comparison.

FAQ

Is Hermes Agent more secure than OpenClaw? Not on anything we can show. Hermes's default puts a model-based check in front of dangerous commands, and OpenClaw's doesn't, but Hermes's own policy says that check isn't a security boundary. Both rely on the operating system or a sandbox you configure.

Do Hermes Agent and OpenClaw run commands on my computer? By default, yes. Hermes uses its local terminal backend and OpenClaw's sandbox mode falls back to off, so commands run on the host unless you configure isolation.

Why does OpenClaw have so many security advisories? It publishes reports through GitHub's advisory database, and it drew a large number of reports after its rapid growth early in 2026. The count reflects disclosure as well as defects, so it isn't a direct safety comparison with Hermes's empty list.

Can I move from OpenClaw to Hermes Agent? Both keep memory as Markdown files, which makes moving facts by hand straightforward. We haven't tested an automated migration in either direction.

Which one have you tested on real tasks? Neither. Our completion rates cover closed personal agents in the exam; these two are source reviews only.