OpenClaw vs Hermes Agent: Features, Local Models and the Security Record

The short answer: OpenClaw is the bigger, TypeScript-based personal assistant built around an always-on Gateway that lives in your chat apps, and Hermes Agent is Nous Research's Python agent built around a self-improving learning loop that you usually park on a server. Both are MIT-licensed, both run fully on local models, and both have had serious security bugs in 2026. OpenClaw's record is far larger and includes several 9.9-rated gateway flaws. Hermes Agent's published CVEs top out at 7.3. Whichever one you run, the risk comes from the same design choice: a long-running process that holds your API keys, reads messages from strangers and can run a shell.

This guide was last checked against the OpenClaw docs and GitHub Security Advisories, the Hermes Agent docs, README and SECURITY.md, the NVD CVE API, the Cloud Security Alliance research note on Hermes Agent, and Koi Security's ClawHub audit on September 24, 2026.

Quick summary

• Who makes them. OpenClaw is run by the OpenClaw Foundation (its docs describe an independent 501(c)(3)). Hermes Agent is built by Nous Research, confirmed in both its README and the CSA research note.
• Current versions. OpenClaw v2026.9.6 (September 23, 2026) and Hermes Agent v0.21.5, tagged v2026.9.24 (September 24, 2026). Hermes CVE ranges use both numbering styles.
• Local models. Both work with Ollama, llama.cpp, vLLM and any OpenAI-compatible endpoint. Hermes requires at least a 64K context window. Its Ollama guide names gemma4:31b as the best local option with tool calling.
• Security record. OpenClaw's GitHub repository lists 722 published security advisories (14 rated critical) between January 31 and September 11, 2026. NVD holds 39 CVE records naming NousResearch hermes-agent, all scored by VulDB, with a highest CVSS 3.1 score of 7.3.
• Supply chain. Koi Security found 341 malicious skills out of 2,857 on ClawHub, OpenClaw's skill marketplace. There is no public study of that scale for Hermes skills.

What each one actually is

OpenClaw started life as Clawdbot (briefly Moltbot), and early advisories still name the clawdbot npm package. The centre of the design is the Gateway, a daemon that holds your model credentials, connects to messaging networks and routes messages to agents, which run tools in a sandbox, on a paired "node" or on a cloud worker. OpenClaw's docs call this "Gateway-owned authority" with deterministic tool policy.

Hermes Agent calls itself "the self-improving AI agent built by Nous Research." It writes new skills after complex tasks, refines them in use, keeps agent-curated memory and searches its past sessions. One gateway process connects it to the chat apps, and seven terminal backends (local, Docker, SSH, Singularity, Modal, Daytona, Vercel Sandbox) mean the shell it drives need not be your laptop's.

If you want the general mechanics of how these loops call tools, our explainer on agent harness architecture covers the pattern both projects follow.

Feature comparison

Installing either takes one line on macOS or Linux:

# OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

# Hermes Agent
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

OpenClaw also needs a provider API key or an existing Claude Code or Codex CLI login. Both have PowerShell installers for native Windows. If you pay for a subscription to power either agent, our comparison of Claude Pro vs Max limits after Opus 5.5 shows how far each plan goes.

Local model support

Both projects treat a local model as a first-class provider, and both warn that a model which answers a short prompt can still fail a full agent turn.

On the "best local LLM for Hermes Agent" question, the Ollama guide says gemma4:31b "is currently the best local option with tool-call support." The smaller Gemma 2 and Llama 3.2 models it lists have no tool calling, which rules them out for agent work. It also warns that Ollama's default 2,048-token context is far too small, so set the context length explicitly.

A minimal Hermes-on-Ollama setup, from the official guide:

# ~/.hermes/config.yaml
model:
  default: "gemma4:31b"
  provider: "custom"
  base_url: "http://localhost:11434/v1"

OpenClaw's local-model page adds a warning that applies to both: "local models do not provide hosted providers' safety filters." Going local keeps your data at home, but it does not make the agent safer to point at untrusted input. For hardware sizing, see our guides to the best local LLM for 16GB of VRAM and DGX Spark vs Mac Studio vs Strix Halo.

The security record

How to read the numbers

The two projects disclose differently, so raw counts are not a fair scoreboard.

• OpenClaw publishes its own GitHub Security Advisories. As of September 24, 2026, the repository lists 722 published advisories: 14 critical, 249 high, 390 medium and 69 low. Only a minority carry a CVE id. Third-party blogs quote totals of 138 or more CVEs. Those figures depend on the counting method, and we could not reproduce them, so we don't use them.
• Hermes Agent had no published GitHub advisories in its repository when we checked. Its CVEs come from VulDB acting as the CVE numbering authority, often after researchers disclosed through pull requests. NVD lists 39 CVE records for NousResearch hermes-agent, published between April 27 and September 3, 2026. NVD has not added its own scores to these, so every score below is VulDB's.

About the "9 CVEs in 4 days" line you may have seen: it comes from the Cloud Security Alliance research note titled "9 CVEs in 4 Days: What Hermes Agent Enterprises Must Learn." The note is about Hermes Agent, but the nine CVEs in its headline are OpenClaw CVEs published March 18–21, 2026, which it uses as the cautionary example. The Hermes CVEs it covers are a separate, smaller set.

OpenClaw: notable vulnerabilities

CVE-2026-25253 was the headline bug. Its fix shipped in 2026.1.29, before public write-ups appeared in early February. Internet-scan figures reported afterwards (40,000+ exposed instances, "63% vulnerable") come from secondary blogs whose methodology we could not check, so treat them as indicative only. The pattern after that is clear from the advisory list itself: the most severe OpenClaw bugs cluster in Gateway authorization, where pairing tokens, reconnects or shared-auth sessions could end up with operator.admin and, through paired nodes, code execution.

Hermes Agent: notable vulnerabilities

Two caveats. Most Hermes records list only an affected version, with no fixed version in NVD, so the practical answer is to run the current release. And several of these bugs sit in components that Hermes' own SECURITY.md calls heuristics rather than containment: the approval gate, output redaction and Skills Guard. The project treats bypasses of those as out of scope and names the operating system as the real boundary. The isolation you choose matters more than any single patch.

Threat model: what actually goes wrong

Four places an always-on agent gateway breaks, common to OpenClaw and Hermes Agent.

The same four risks apply to both agents. They differ mainly in how exposed the defaults leave you.

1. The always-on gateway is an internet service. It holds model keys and can dispatch shell commands. OpenClaw now binds to loopback by default, answers unknown DM senders with a pairing code and allowlists groups. Hermes' SECURITY.md says never to expose the gateway or API without a VPN or firewall. Most of the worst OpenClaw bugs above only matter once the gateway is reachable. The control-plane ideas in our piece on runtime authorization for AI tool calls apply directly here.

2. Skills and plugins are unreviewed code with full privileges. The ClawHavoc campaign Koi Security uncovered used skills posing as crypto trading tools. Their "install prerequisites" steps delivered the AMOS infostealer and backdoors to macOS and Windows users. OpenClaw responded in February 2026 by scanning every ClawHub upload with VirusTotal, and its maintainers said that scanning is "not a silver bullet." Hermes documents that plugins "load into the agent process and run with full agent privileges" and tells operators to read a skill's Python code, not just its SKILL.md. The lesson from Mini Shai-Hulud and trusted publishing holds: a trusted registry does not make a trusted package.

3. Credential blast radius. Both agents keep provider keys, bot tokens and often cloud or SSH credentials on the same host as the agent loop, and CVE-2026-25253 leaked exactly that gateway token. Scope keys narrowly and prefer short-lived tokens. Our guide to non-human identity management covers the pattern.

4. Prompt injection through chat channels. Anyone who can message the bot, add it to a group or email it can supply instructions. With Hermes the injected text can also persist in memory or a self-written skill. As we argued in indirect prompt injection puts enterprise AI agents at risk, filters alone will not stop it. Limit what the agent can do after it has been fooled. If your agent also talks to MCP servers, the controls in zero trust for MCP apply too.

Hardening checklist

Work through this for whichever agent you run. Items marked (OC) or (H) are specific to one project.

Patch and inventory

• Update to the current release: OpenClaw v2026.9.6 or later, Hermes Agent v0.21.5 or later. Subscribe to OpenClaw's GitHub advisories and watch NVD for hermes-agent.
• (OC) Run openclaw security audit after every upgrade and config change.
• (H) If you use the community hermes-webui, run 0.50.34 or later.

Network exposure

• Keep the gateway on loopback. Reach it remotely through Tailscale, a VPN or an authenticating reverse proxy, never a raw open port.
• (OC) Follow the Gateway exposure runbook before binding beyond loopback, and keep bypass flags off in production.
• (H) Do not expose the API server or webhook adapters publicly without a firewall.

Who can talk to it

• (OC) Keep DM pairing on, allowlist groups, and enable per-sender session isolation if more than one person uses it.
• (H) Configure a caller allowlist for every adapter you enable (Telegram, Discord, Slack, email).

Isolation

• Run as a non-root user on a dedicated VM or container, not your daily workstation.
• (H) For untrusted content, wrap the whole process in Docker or NVIDIA OpenShell. A Docker terminal backend alone does not cover code execution, MCP subprocesses or plugins.
• (OC) Use sandboxed execution, restrict system.run on nodes, and use per-agent access profiles.
• Leave auto-approve ("YOLO") modes off.

Skills and plugins

• Install skills only from sources you have read. Pin versions and reinstall deliberately.
• (OC) Treat ClawHub's VirusTotal verdict as one signal. Consider disabling dynamic skills on production agents.
• (H) Review self-written skills and memory entries on a schedule so injected instructions don't persist.

Secrets

• Give each agent its own API keys with spend caps. Never reuse your personal cloud admin credentials.
• Lock .env and config files to the agent user (mode 0600).
• If a gateway token or key may have leaked, rotate everything the host held, not only the one secret.

Monitoring

• Log tool calls and outbound connections, and alert on new skill installs and config changes.

Which should you pick?

• You want a personal assistant across many chat apps and a big skill ecosystem: OpenClaw. Accept that you are running a fast-moving Gateway with a long advisory history. Stay current and keep it off the public internet.
• You want an agent on a VPS that learns your workflows and runs scheduled jobs: Hermes Agent. Pick a whole-process sandbox from day one, because its own policy says the in-process guards are not a boundary.
• You are privacy-driven and want everything local: either works. Hermes gives the clearer model guidance (64K context, gemma4:31b). Budget 24 GB or more of memory for real tool use.
• You are an enterprise evaluating either for staff: neither ships the identity, audit and policy controls of a managed product. Pilot on isolated hosts with scoped credentials.

FAQ

Is Hermes Agent more secure than OpenClaw?

Its published record is smaller and less severe: 39 NVD CVEs with a top score of 7.3, against OpenClaw's 722 GitHub advisories including 9.9-rated gateway flaws. But OpenClaw has far more users and security researchers looking at it, and the two disclose differently. Hermes also treats its approval and scanning layers as heuristics. Security depends mostly on how you deploy either one.

Who makes Hermes Agent?

Nous Research. The GitHub repository is NousResearch/hermes-agent and it is MIT-licensed.

How do I install Hermes Agent?

On Linux, macOS, WSL2 or Termux run curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash, then reload your shell and run hermes. On native Windows use iex (irm https://hermes-agent.nousresearch.com/install.ps1). The desktop app for macOS and Windows is on the project site.

What is the best local LLM for Hermes Agent?

The official Ollama guide recommends gemma4:31b for full agentic work because it supports tool calling. It needs about 20 GB of disk and 24 GB or more of RAM. Whatever you pick needs at least a 64K context window.

Was CVE-2026-25253 exploited, and am I still vulnerable?

It affected OpenClaw (then Clawdbot) before 2026.1.29 and carries a CVSS 3.1 score of 8.8. Some security blogs describe in-the-wild exploitation, but we found no authoritative confirmation such as a CISA KEV listing. Any install updated since late January 2026 has the fix. If you ran an older build with an exposed Control UI, rotate the gateway token and provider keys.

What are good OpenClaw alternatives?

Hermes Agent is the closest self-hosted alternative. If you mainly want coding help, a terminal coding agent is narrower and easier to contain; see our coding-agent CLI comparison.

Related reading

• Best Open-Weight AI Models for a 48GB Apple Silicon Mac in 2026
• Claude Opus 5.5 Is Anthropic's Strongest Cyber Model Yet, So Most Security Work Goes to Opus 4.8
• The RTX 5090 (32GB) Local LLM Deployment Blueprint: NVFP4 vs. FP8, SGLang vs. vLLM, and Context Limits