Hermes vs OpenClaw: how we choose a self-hosted AI agent platform

Last updated: 9 August 2026

We install both. That is the only reason this comparison is worth reading, because most of the pages ranking for this question are written either by hosting companies with a commercial interest in the answer or by people who have never run either platform on a server somebody depends on.

The short version: OpenClaw carries roughly seventeen times as many published CVEs as Hermes Agent, and that number is not the verdict it looks like. Read both projects' own security policies and you find the same two admissions: neither is a multi-tenant system, and in both, the operating system is the only real security boundary. The platform choice matters far less than whether you can resource the operations. If you can, pick on integration breadth versus isolation defaults. If you cannot, neither is safe to run.

They are closer than the comparison posts suggest

Both are MIT-licensed, self-hosted agent runtimes that connect a language model to your messaging apps, your files and your shell. Both are moving fast. Both are genuinely useful. If you are still deciding whether to self-host an agent at all, start with the broader case rather than the platform question, because the answer to that one changes this one.

	OpenClaw	Hermes Agent
Maintainer	OpenClaw Foundation	Nous Research
Repository created	November 2025	July 2025
Current release	2026.7.1-2, 4 August 2026 [1]	v0.20.0, 3 August 2026 [2]
Runtime	Node.js 22+	Python 3.11 plus Node.js
Design centre	Breadth of messaging channels, multi-agent orchestration	Persistent memory, self-created skills, pluggable execution backends
Model providers	Not locked in. Bundled plugins for OpenAI, Anthropic, Gemini and 20 or more hosted services, plus Ollama, LM Studio and vLLM for local models [3]	Not locked in. Nous Portal, OpenRouter, OpenAI, or any custom endpoint [4]
Published CVEs (9 August 2026)	575 [5]	33 [6]

That last row is what everyone fixates on. It deserves more care than it usually gets.

What the CVE gap actually measures

Take the numbers seriously first. Querying the National Vulnerability Database directly on 9 August 2026 returns 575 CVEs matching OpenClaw [5]. An independent tracker that reconciles against the raw CVE registry rather than NVD's enrichment layer puts it at 543 [7]. Of the 194 that NVD has finished scoring, 32 are Critical and 75 High [5]. The remainder are still queued for analysis, which is a backlog, not an all-clear. Hermes returns 33 [6].

Now look at who filed them. On the independent tracker, 34 of OpenClaw's CVEs were issued by the project itself through GitHub's CNA, and 509 came from third parties, of which roughly 500 trace to a single research organisation working systematically through the codebase [7]. On the Hermes side, every one of the 33 came from one source, VulDB. Not one has reached NVD's own "Analyzed" status. The highest score across all 33 is 7.3, and the description of at least one records that "the vendor was contacted early about this disclosure but did not respond in any way" [6]. Nous Research has published zero security advisories of its own [8].

So the honest reading is not "OpenClaw is seventeen times buggier". It is closer to this: one project attracted a sustained, systematic research campaign and runs an active advisory programme, and the other has not yet drawn that attention and does not publish advisories. A thin CVE record is evidence of less scrutiny, not evidence of a safer codebase. In our audits we treat an empty vulnerability history on a young, fast-moving project as a question to investigate, never as a reassurance, and the same discipline applies here.

There is a second reason the counts are not comparable, and it is written into both policies. OpenClaw excludes "prompt-injection-only attacks (without a policy/auth/sandbox boundary bypass)" from scope [9]. Hermes excludes "prompt injection without chained" isolation-escape outcomes [10]. Whole classes of real-world agent failure therefore never become a CVE in either project, which is defensible engineering practice and a trap if you are counting CVEs to compare safety. If you want to understand that failure class, it is the one we wrote about separately, and it is first on the OWASP list for LLM applications.

Both projects tell you the same uncomfortable thing

This is the part buyers miss, and it is stated plainly in the primary sources rather than hidden.

OpenClaw's security policy: the software "is local-first agent infrastructure for trusted operators; it is not designed as a shared multi-tenant boundary between adversarial users on one gateway." Authenticated callers "are treated as trusted operators", and session identifiers are "routing controls, not per-user authorization boundaries" [9].

Hermes' security policy goes further, and to its credit:

The only security boundary against an adversarial LLM is the operating system. Nothing inside the agent process constitutes containment - not the approval gate, not output redaction, not any pattern scanner, not any tool allowlist.

-- Nous Research, hermes-agent SECURITY.md [10]

That is one of the more honest sentences in agent tooling, and it is the correct mental model for both platforms. Neither ships role-based access control. Neither is an enterprise multi-user product, whatever a comparison table implies. If your requirement is several people with different permission levels sharing one agent, the answer is not Hermes and it is not OpenClaw. It is a different architecture, and we would tell you so before quoting for either installation.

The four things that actually decide it

Once you accept that the operating system is the boundary, the choice narrows to four practical questions.

1. What runs on the host by default

OpenClaw's default sandbox mode is non-main: sessions from groups and channels are sandboxed, and your own main session's tools are not [11]. The documentation itself calls this a common surprise. Hermes defaults to a local terminal backend that "runs as the same OS user", and its docs are explicit that production deployments should use one of the docker, modal, daytona or vercel_sandbox backends "to isolate agent commands from your host system" [12].

Neither is sandboxed out of the box for the operator's own session. Hermes ships more first-class isolation backends; OpenClaw expects you to configure it. Either way this is the first thing we change on an install, and it is the same reasoning we applied to granting an agent access to your servers at all. It is also, in our experience, where agents fail once they reach production: not in the model, but in what the model was permitted to reach.

2. How much integration surface you are buying

OpenClaw's breadth across messaging channels is its genuine advantage and its largest attack surface. A meaningful share of its CVEs are channel-plugin-specific: Telegram, Feishu, QQBot, Zalo, Matrix and Discord handling bugs [7]. More integration code means more bugs, reliably. If you need the agent on six platforms, OpenClaw is the shorter path and you are accepting that surface. If you need it on one, you are paying for surface you will never use.

3. Who curates the skills you install

A skill is code that runs with the agent's permissions, so the registry is a supply chain. Koi Security audited every skill on ClawHub in February 2026 and found 341 malicious ones, 335 from a single campaign, revised to 824 by 16 February 2026 as the registry grew past 10,700 skills [13]. OpenClaw added automated scanning of uploads on 11 February 2026. Unit 42 then checked whether scanning had solved it and found five malicious skills that got through, including two macOS infostealers with live command-and-control infrastructure and one padded to 22 MB to exceed the scanner's size limit [14].

The important finding is the one that covers both platforms. Snyk's ToxicSkills study audited 3,984 skills across ClawHub and skills.sh, the registry compatible with the open standard Hermes uses, and found 13.4 per cent carried at least one critical-severity issue and 36.82 per cent at least one issue of any severity [15]. Curated subsets scored dramatically better than open ones. The variable that predicts risk is curation, not which platform you chose. Treat every skill as an unreviewed dependency with shell access, because that is what it is.

4. Whether you can sustain the patch cadence

At its March to April 2026 peak, OpenClaw was averaging roughly three published CVEs a day [7]. It now runs three supported release lines concurrently, patched every few days [1]. Meanwhile Mandiant's M-Trends 2026, drawn from more than 500,000 hours of incident response, puts the mean time from disclosure to exploitation at negative seven days, down from 63 days in 2018 [16]. Exploitation now routinely precedes the advisory.

Put those together honestly. A self-hosted OpenClaw instance is a standing operational commitment measured in weekly hours, not a weekend project. Hermes' slower CVE stream lowers that specific burden, though partly for the attention reasons above. This is the single most common reason we advise a client against self-hosting at all, and it has nothing to do with which platform they picked.

How we actually choose

For a client with the operations capability to run either:

• Choose OpenClaw when the requirement is breadth: several messaging channels, a large community skill ecosystem, orchestration across multiple agents. Budget for the patch cadence and harden it properly, which is what our hardening guide sets out step by step.
• Choose Hermes when the requirement is a long-running agent on modest hardware with persistent memory, and when you want container or remote-sandbox execution as a first-class configuration rather than something you bolt on.
• Choose neither when the requirement involves multiple users at different permission levels, regulated data the agent would hold unsupervised, or a team with no capacity for a standing patch window. This is a real answer and we give it regularly.

One thing we will not do is tell you which is more capable. No credible independent benchmark comparing the two on capability exists. We checked. The nearest academic work compares harness adapters within OpenClaw only and does not mention Hermes [17], and the vendor comparisons circulating self-disclose as first-party claims rather than independent validation. Anyone presenting a capability league table between these two is presenting an opinion.

What UK buyers should know before signing anything

"Self-hosted" usually still means a hosted model. For both platforms, unless you deliberately wire in a local runner such as Ollama or vLLM [3], only the runtime, memory, tools and secrets sit on your infrastructure. The prompts still leave for a model provider. That distinction decides your controller and processor analysis under UK GDPR, and it surprises people who believed self-hosting had settled the question.

The ICO's most relevant publication, Tech Futures: Agentic AI, is framed by the ICO itself as early thinking rather than formal guidance [18], so treat it as direction of travel. Its themes are pointed for agents: processing purposes broaden unpredictably, and the ICO does not consider it workable to push governance onto end users. The NCSC's May 2026 guidance is more directly actionable and notably does not distinguish self-hosted from vendor-hosted [19]: least privilege, shortest-lived credentials, active monitoring, supply-chain management, named accountability. The controls are the same either way. Self-hosting simply means nobody else is implementing them for you.

On the EU AI Act, one correction worth having, because it is widely reported wrongly. Article 50 transparency obligations did become applicable on 2 August 2026 [20], so a client-facing agent built on either platform needs its disclosures live now if it touches EU users. But the high-risk obligations that were also scheduled for that date were postponed to 2 December 2027 by the Digital Omnibus on AI, in force since 27 July 2026 [21]. Only the transparency layer is live.

Frequently asked questions

Is OpenClaw less secure than Hermes because it has more CVEs?

No, not on that evidence alone. OpenClaw has 575 published CVEs against Hermes' 33, but around 500 of OpenClaw's came from one research organisation working through the code systematically, while all 33 Hermes entries came from a single source that reports the vendor did not respond. Less scrutiny is not more safety.

Can you run Hermes and OpenClaw together?

Yes, and some teams do, using one for messaging breadth and the other for execution. We would generally advise against it for a first deployment. Two agent runtimes means two patch cadences, two sets of credentials and twice the surface, for a benefit most organisations do not actually need in year one.

Which is safer to expose to the internet?

Neither. Both are designed as single-operator infrastructure, and both projects say so in their own security policies. The correct pattern for either is to keep the interface bound to localhost and reach it through a VPN or an SSH tunnel. More than 135,000 exposed OpenClaw instances were observed in February 2026, which is the cautionary tale [22].

Do I need a security team to self-host an agent?

Not a team, but you do need a standing owner and a weekly hour. The work is a patch window, a log review and a periodic prune of skills and permissions. What catches people out is that this never ends. If nobody owns it by name, the honest recommendation is to have it managed rather than self-host.

Does self-hosting mean my data stays in the UK?

Only if you also run the model locally. By default both platforms call a hosted model provider, so prompts and any context leave your infrastructure even though the agent runtime does not. Running a local model through Ollama or vLLM closes that gap, at a real cost in capability and hardware.

Getting it right, on either platform

If you are choosing between these two, the honest headline is that the decision matters less than the operations behind it. A well-run OpenClaw is safer than a neglected Hermes, and the reverse is equally true.

That is the service we sell: OpenClaw installation and hardening, Hermes Agent installation and migration, and ongoing management so the patch window and the log review actually happen. If you are not sure which fits, tell us what you want the agent to do and we will tell you which one we would put on your server, including when the answer is neither.

If the agent is going near code that ships to customers, that is a different question again, and one our audit is built for.

OpenClaw and Hermes Agent are independent open-source projects. Zegaware is not affiliated with or endorsed by either.

Sources

1. OpenClaw, GitHub Releases (release lines 2026.7.1-2 and extended-stable 2026.6.34), checked 9 August 2026. https://github.com/openclaw/openclaw/releases
2. Nous Research, "Hermes Agent v0.20.0, The Herald Release", 3 August 2026. https://github.com/NousResearch/hermes-agent/releases/tag/v2026.8.3
3. OpenClaw documentation, Model providers (bundled plugins for Ollama, LM Studio and vLLM, plus custom OpenAI-compatible endpoints). https://docs.openclaw.ai/concepts/model-providers
4. Hermes Agent documentation, overview (Nous Portal, OpenRouter, OpenAI, or any endpoint). https://hermes-agent.nousresearch.com/docs/
5. NIST National Vulnerability Database, CVE API product query cpe:2.3:a:openclaw:openclaw, queried 9 August 2026. https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:openclaw:openclaw
6. NIST National Vulnerability Database, CVE API keyword query hermes-agent, queried 9 August 2026. https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=hermes-agent
7. jgamblin/OpenClawCVEs, community CVE tracker reconciled against the CVEProject/cvelistV5 registry, last run 9 August 2026. https://github.com/jgamblin/OpenClawCVEs
8. Nous Research, hermes-agent security advisories page ("There aren't any published security advisories"), checked 9 August 2026. https://github.com/NousResearch/hermes-agent/security
9. OpenClaw, Security Policy (trust model, single-operator scope, prompt-injection-only exclusion). https://github.com/openclaw/openclaw/security/policy
10. Nous Research, hermes-agent SECURITY.md (operating system as the only security boundary; scope exclusions). https://github.com/NousResearch/hermes-agent/blob/main/SECURITY.md
11. OpenClaw documentation, "Sandbox vs tool policy vs elevated" (default sandbox mode non-main). https://docs.openclaw.ai/gateway/sandbox-vs-tool-policy-vs-elevated
12. Hermes Agent documentation, Security (local terminal backend runs as the same OS user; docker, modal, daytona and vercel_sandbox recommended for production). https://hermes-agent.nousresearch.com/docs/user-guide/security
13. Koi Security, "ClawHavoc: 341 malicious skills found by the bot they were targeting", 1 February 2026, updated 16 February 2026 to 824 malicious skills. https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting
14. Palo Alto Networks Unit 42, "OpenClaw's skill marketplace and the emerging AI supply chain threat", 23 June 2026. https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/
15. Snyk, "ToxicSkills: prompt injection in 36%, 1,467 malicious payloads in a study of the agent skills supply chain", 5 February 2026 (3,984 skills audited across ClawHub and skills.sh). https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/
16. Google Cloud / Mandiant, M-Trends 2026, published March 2026 (mean time to exploit of negative seven days, from 63 days in 2018). https://cloud.google.com/security/resources/m-trends-executive-edition
17. "Claw-SWE-Bench: a benchmark for evaluating OpenClaw-style agent harnesses on coding tasks", arXiv:2606.12344, 10 June 2026 (compares harness adapters within OpenClaw; does not cover Hermes). https://arxiv.org/abs/2606.12344
18. Information Commissioner's Office, "ICO tech futures: agentic AI", January 2026 (published as early thinking, not formal guidance). https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/
19. National Cyber Security Centre, "Thinking carefully before adopting agentic AI", 15 May 2026. https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai
20. Regulation (EU) 2024/1689 (the AI Act), Article 50, transparency obligations applicable from 2 August 2026. https://eur-lex.europa.eu/eli/reg/2024/1689
21. Regulation (EU) 2026/1744 ("Digital Omnibus on AI"), Official Journal 24 July 2026, in force 27 July 2026, postponing Annex III high-risk obligations to 2 December 2027. https://eur-lex.europa.eu/eli/reg/2026/1744/oj
22. SecurityScorecard STRIKE, "How exposed OpenClaw deployments turn agentic AI into an attack surface", 11 February 2026 (135,000-plus instances across 82 countries; 35.4% flagged vulnerable to remote code execution). https://securityscorecard.com/blog/how-exposed-openclaw-deployments-turn-agentic-ai-into-an-attack-surface/