# Hermes Agent vs OpenClaw: memory, security and who else is in the room

> Hermes Agent and OpenClaw are both free, MIT-licensed agents you run on your own machine or server. Compared as of 21 October 2026 on setup, models and logins, memory, approvals and security advisories, and what happens when several people share one agent, with DigiSapiens as a third shape.

By Selin and Kemal Şerbet. Published 2026-10-26. Canonical: https://digisapiens.ai/blog/hermes-agent-vs-openclaw

## Key takeaways

- Both are free and MIT-licensed; you pay your model provider and, for an always-on agent, a small server.
- Hermes Agent keeps a small, hand-editable memory and screens dangerous commands by default, asking you about the uncertain ones; OpenClaw keeps memory as growing Markdown files and defaults to full access unless you configure permission modes or sandboxing.
- OpenClaw has the deeper team model: shared sessions anyone permitted can steer or take over, and named operator roles, inside one trust domain per gateway. Hermes gives each person in a shared chat their own session by default.
- With a Claude subscription, OpenClaw reuses your Claude Code login within its limits; Hermes reaches Claude only on Max with purchased extra usage.

Hermes Agent and OpenClaw are both free, MIT-licensed AI agents that you run on your own computer or server and talk to through chat apps. Hermes Agent, from Nous Research, is a personal agent with a small memory you can read and edit, and by default it screens dangerous commands and asks you about the uncertain ones. OpenClaw, stewarded by the OpenClaw Foundation, is a gateway a whole team can share, with shared sessions and named roles, but its default permission is full access and its advisory list is far longer. If you are one person choosing for yourself, the head-to-head reports we found lean to Hermes; if a trusting team wants to work in the same sessions, OpenClaw goes further. This Hermes Agent vs OpenClaw comparison holds as of 21 October 2026.

Both shipped new releases between 13 and 18 October. Hermes v0.22.2 came out on 15 October, the release v0.22.1 "was meant to be" after it "was built from the wrong commit"; the features arrived in v0.22.0 on 13 October. OpenClaw 2026.10.5 came out on 18 October. On GitHub, Hermes has 255,667 stars and OpenClaw 392,703. We build DigiSapiens, a third shape, so it gets a short section with its weak points.

## At a glance

Every Hermes Agent and OpenClaw cell comes from the makers' pages, GitHub or the US National Vulnerability Database (NVD), read on 21 October 2026.

| | Hermes Agent | OpenClaw | DigiSapiens |
|---|---|---|---|
| Maker, license | Nous Research, MIT | OpenClaw Foundation (non-profit), MIT | DigiSapiens, closed source |
| Tool fee | None; optional Nous Portal, free or $20 to $200 a month | None; "no paid version" | Closed beta; price not published |
| Claude subscription | Max plus purchased extra usage only | Reuses your Claude Code login | Your Claude Code login |
| Memory | Two capped files, editable | Markdown files that grow, consolidated nightly | Per agent, with a name and role |
| Default posture | Screens dangerous commands; asks you when unsure | Full access unless configured | Outward-facing drafts wait for the owner |
| Advisories | 0 on its repo; 6 NVD CVEs in September | 722 on its repo; 77 NVD CVEs in September | Not tracked here |
| Several people | Own session each, by default | Shared sessions, roles, take over | Shared channels with people and agents |
| Where you talk to it | Desktop app, terminal, 20 chat platforms | Desktop apps, Control UI, 29 channels | Its own Mac app |

## Setup, cost and logins

Nous says Hermes is "up and running in under two minutes"; OpenClaw says "about 5 minutes". The Hermes desktop app runs on macOS 12 or later (stable builds are Apple Silicon only) and Windows 10 and 11, with Python 3.14 bundled; on Linux you install from the terminal. Since v0.22.0 a fresh desktop install "opens on a guided setup chat that runs on a free trial model", so you talk to it before you own an API key. OpenClaw needs Node 24.16 or 26.1 and up, which its installer provides, and runs on macOS 15 or later, Windows and Linux, with iOS and Android apps that pair to your own gateway.

Neither charges for the tool. OpenClaw has "no enterprise edition and no paid version"; OpenClaw Enterprise, announced on 29 September, is a separate free project still before its 1.0 release. Hermes offers the optional Nous Portal at $0, $20, $100 and $200 a month, with $22, $110 and $220 of model credit on the paid tiers, and a Hermes Cloud host that says "You only pay while it works" without publishing a rate.

An always-on agent needs a machine that stays on. Dhawal Shah, who ran both, wrote on 12 October that the Hermes server cost about US$5 a month and the OpenClaw server about US$7.50. Setup took "about 90 minutes (with OpenClaw experience)" for Hermes and "About 2 hours, then a lot of debugging" for OpenClaw.

### Logins: the Claude question

Both take API keys from the major providers and local models. The difference is what happens with a subscription you already pay for.

OpenClaw can "reuse an existing Claude Code login through the installed executable on the same host", and that usage "still draw[s] from the signed-in subscription's usage limits". For ChatGPT it offers Sign in with ChatGPT (beta), a Codex login or an API key, and its docs state that "OpenAI explicitly supports subscription OAuth usage in external tools and workflows like OpenClaw." OpenClaw also warns that "Anthropic can change Claude Code billing and rate-limit behavior without an OpenClaw release."

Hermes is stricter on Claude. Its provider page says the subscription path "only works if you're on a Claude Max plan and have purchased extra usage credits", that the base Max allowance "is not consumed by Hermes", and that "Claude Pro subscribers cannot use this path." If it has no login of its own, Hermes will by default borrow an existing Claude Code or Codex CLI login and refresh it for you, a setting that is on unless you turn it off, but the Claude condition still applies. A ChatGPT or Codex login works; which plan tiers qualify is "not currently documented".

## Memory: a small notebook or a growing archive

Hermes memory is two files: MEMORY.md, capped at 2,200 characters, and USER.md, capped at 1,375, "injected into the system prompt as a frozen snapshot at session start". It "does not auto-compact": a write past the limit returns an error instead of dropping entries. You can read the files directly, "prune and correct" what Hermes has learned in its journey timeline, and switch on a setting that requires approval before each save. The cap is the complaint: Dhawal Shah wrote that once the agent handled dozens of topics, the memory "filled up. I had to build a memory layer on top".

OpenClaw writes "plain Markdown files in your agent's workspace", with "no hidden state": a MEMORY.md, a USER.md and daily notes that a nightly "dreaming" sweep distills into MEMORY.md. When that file outgrows its budget, OpenClaw keeps it on disk but truncates the copy the model sees. It has semantic search, a command to inspect and edit memory, and its Control UI can import existing memory from Codex, Claude Code and Hermes. The complaint here is reliability: the same reviewer wrote that OpenClaw's "memory kept failing on me", and the 2026.10.5 release lists memory reliability fixes. OpenClaw's own docs add a caution worth keeping: "Memory can preserve approval context, but it does not enforce policy."

## Security: approvals, sandboxes and the advisory count

Hermes checks every command against a list of dangerous patterns. In the default mode a second model assesses each match first: low-risk commands are approved, clearly dangerous ones are denied, and uncertain cases come to you. Scheduled and unattended runs default to deny. With no allowlist configured, "all users are denied". The default local backend runs commands on the host with no isolation; the Docker, SSH, Singularity and Modal backends run them elsewhere.

OpenClaw offers four permission modes, from read-only to full, but "Without those settings or sandboxing, the default is full access", and "Sandboxing is off by default". Its trust model supports "one trust boundary per gateway", a single operator or "a mutually trusting team", and not a gateway shared by people who do not trust each other. In February Microsoft advised that OpenClaw "is not appropriate to run on a standard personal or enterprise workstation" and belongs in an isolated machine. Since then OpenClaw has completed an audit through OpenAI's Patch the Planet initiative (21 September), and 2026.10.5 made sending to a session "without granting transcript access" stable.

The advisory numbers differ by an order of magnitude, but read them with care. OpenClaw publishes 722 advisories on its own repository, 14 of them critical, the newest batch of 75 on 11 September; NVD published 77 OpenClaw CVEs in September, one critical (CVE-2026-100551, 9.0, saved TLS pins not enforced in the iOS app, fixed in 2026.8.11). Hermes lists no advisories on its repository; the GitHub advisory database holds 10 reviewed Hermes advisories, the newest from June, and NVD published six Hermes CVEs between 1 and 3 September, three medium and three low, affecting 0.18.x, and several say the vendor "was contacted early about this disclosure but did not respond in any way." A long list that ships fixes and a short list with unanswered reports tell you different things. Neither project had a named incident in the last 60 days that we could find.

## Who else is in the room

This is where the two differ most, and where most comparisons stop short.

Hermes runs in group chats on Discord, Slack, Microsoft Teams and many other platforms. By default each person gets their own session: "Alice and Bob can both talk to Hermes in the same Discord channel without sharing transcript history." You can switch to one shared "room brain" instead. Allowlists decide who may talk to it; we found no per-person roles. Hermes' teammates are mostly other bots: in Bot Mode several Hermes profiles message each other, and v0.22.0 added Bot Screen, where on a headless Linux host "each bot gets its own desktop" you can watch and "take over when it hits a login, 2FA prompt, CAPTCHA or payment step". It is off by default, needs about 1.1 to 1.5 GB per open screen, and the docs say plainly that screens "are work surfaces, not security boundaries".

OpenClaw was designed for the room. Its teams guide describes "one OpenClaw gateway that a whole team uses": a bot in your existing chat, "shared sessions everyone can open and steer", live presence showing "who is viewing and who is typing", and "roles that bound what each person can do". Teammates can connect their own model accounts. The limit is stated just as clearly: "A gateway is one trust domain", and with view access "guests can still read every shared session, including tool output."

The users are split too. On 5 October one Hacker News commenter called OpenClaw "laggy slow and buggy" and said "Hermes just feels more thought through"; another, running Hermes on a VPS with Matrix, found "the actual maintenance has been very minimal." On 25 September an OpenClaw user who makes ads wrote that the ads it now produces have "performed better than when I was doing it all manually."

## A third shape: DigiSapiens

We build DigiSapiens, and it starts where both projects end up: several people and several named agents in the same room. Each agent has a name, a role, a memory and an owner, and works in channels next to people, with projects, issues and pull requests. The room has walls: an agent reads and writes only the channels it is a member of, even channels open to every person in the workspace, and the server enforces that. Outward-facing or structural work waits as a draft for the owner's approval. Setup is a Mac app and one conversation with Digi, the AI Chief of Staff, who proposes agents and channels and sets them up once approved; there is no server to run.

The agents run on the owner's Mac on their own Claude Code or Codex login, another agent CLI, or any model with an API key, and nothing is metered or resold. ETREXIO, the two-person software studio in Istanbul where the idea started in December 2024, is the first client and runs its daily work this way. The tradeoffs: Mac only for now (iPhone and Android are on the way), in the closed beta agents that stop when the owner's Mac does, no Slack or Discord bridge, closed source, and a closed beta with a [waitlist](https://digisapiens.ai) whose price after the first six free months is not published.

## How to choose, by situation

- One person, a Claude Pro or ChatGPT plan, wants a personal agent with a memory you can see: Hermes Agent, with an Anthropic API key or the Nous Portal, which lists Claude models, for Claude.
- A small team that trusts each other wants one agent in Slack or Discord and wants to steer the same sessions: OpenClaw, with permission modes and sandboxing turned on before anyone connects real accounts.
- You want your Claude Code login to power the agent without buying extra usage: OpenClaw, or DigiSapiens.
- Several people and several named agents in shared channels, with approvals and no server to run, on a Mac, closed beta accepted: DigiSapiens.

More agents in the same space are in our [OpenClaw alternatives comparison](https://digisapiens.ai/blog/openclaw-alternatives-2026).

## Frequently asked questions

### Is Hermes Agent better than OpenClaw?

For one person, the two dated head-to-head reports we found favor Hermes Agent: one reviewer who ran both picked Hermes for most people on 12 October 2026, after OpenClaw's memory kept failing, while noting Hermes is not maintenance-free. For a trusting team that wants to share and take over sessions, OpenClaw has the deeper model, with named operator roles and 29 chat channels. Both are free and MIT-licensed as of 21 October 2026.

### Can Hermes Agent or OpenClaw use my Claude subscription?

OpenClaw can reuse an existing Claude Code login through the installed executable on the same machine, and that usage draws from your subscription's own limits. Hermes Agent reaches Claude through a subscription only on a Claude Max plan with purchased extra usage credits; Hermes usage bills as extra usage and Claude Pro subscribers cannot use that path. Otherwise both take an Anthropic API key.

### Which is more secure, Hermes Agent or OpenClaw?

Neither is a sandbox by default: Hermes runs commands on the host unless you pick a container backend, and OpenClaw sandboxing is off. Hermes screens commands that match its dangerous-command list with a second model, which approves low-risk ones, blocks clearly dangerous ones and asks you about the rest, and it denies unknown chat users. OpenClaw defaults to full access unless you set permission modes or sandboxing, supports one trust boundary per gateway, and lists 722 security advisories on its repository as of 21 October 2026. Hermes lists none on its repository, but the US National Vulnerability Database published six Hermes CVEs in early September 2026.

### Can a team share Hermes Agent or OpenClaw?

OpenClaw is built for it: one gateway a trusting team uses from Slack, Discord, Microsoft Teams or other chat apps, with shared sessions people can open, steer and take over, and roles that limit what each person can do. Hermes Agent works in group chats too, but by default gives each person their own session, and we found no per-person roles.

## Sources

- [Hermes Agent](https://hermes-agent.nousresearch.com/), Nous Research
- [Hermes Agent v0.22.0, The Threshold Release](https://github.com/NousResearch/hermes-agent/releases/tag/v0.22.0), GitHub
- [Hermes Agent v0.22.2](https://github.com/NousResearch/hermes-agent/releases/tag/v0.22.2), GitHub
- [Hermes Agent installation](https://hermes-agent.nousresearch.com/docs/getting-started/installation), Hermes Agent Docs
- [Hermes Agent AI providers](https://hermes-agent.nousresearch.com/docs/integrations/providers), Hermes Agent Docs
- [Hermes Agent memory](https://hermes-agent.nousresearch.com/docs/user-guide/features/memory), Hermes Agent Docs
- [Hermes Agent security](https://hermes-agent.nousresearch.com/docs/user-guide/security), Hermes Agent Docs
- [Hermes Agent platform support](https://hermes-agent.nousresearch.com/docs/getting-started/platform-support), Hermes Agent Docs
- [Hermes Agent messaging](https://hermes-agent.nousresearch.com/docs/user-guide/messaging), Hermes Agent Docs
- [Hermes Agent profiles](https://hermes-agent.nousresearch.com/docs/user-guide/profiles), Hermes Agent Docs
- [Nous Portal](https://hermes-agent.nousresearch.com/docs/integrations/nous-portal), Hermes Agent Docs
- [Hermes Cloud](https://portal.nousresearch.com/cloud), Nous Research
- [Hermes Agent sessions](https://hermes-agent.nousresearch.com/docs/user-guide/sessions), Hermes Agent Docs
- [Hermes Agent Bot Screen](https://hermes-agent.nousresearch.com/docs/user-guide/features/bot-screen), Hermes Agent Docs
- [OpenClaw](https://openclaw.ai/), OpenClaw Foundation
- [OpenClaw 2026.10.5](https://github.com/openclaw/openclaw/releases/tag/v2026.10.5), GitHub
- [OpenClaw getting started](https://docs.openclaw.ai/start/getting-started), OpenClaw Docs
- [Install OpenClaw](https://docs.openclaw.ai/install), OpenClaw Docs
- [OpenClaw blog](https://openclaw.ai/blog), OpenClaw Foundation
- [OpenClaw Enterprise](https://openclaw.ai/blog/openclaw-enterprise), OpenClaw Foundation
- [OpenClaw for teams](https://docs.openclaw.ai/start/teams), OpenClaw Docs
- [OpenClaw Anthropic provider](https://docs.openclaw.ai/providers/anthropic), OpenClaw Docs
- [OpenClaw OpenAI provider](https://docs.openclaw.ai/providers/openai), OpenClaw Docs
- [OpenClaw memory](https://docs.openclaw.ai/concepts/memory), OpenClaw Docs
- [OpenClaw permission modes](https://docs.openclaw.ai/gateway/permission-modes), OpenClaw Docs
- [OpenClaw sandboxing](https://docs.openclaw.ai/gateway/sandboxing), OpenClaw Docs
- [OpenClaw trust model](https://docs.openclaw.ai/gateway/security/trust-model), OpenClaw Docs
- [OpenClaw security advisories](https://github.com/openclaw/openclaw/security/advisories), GitHub
- [CVE-2026-100551 (OpenClaw for iOS TLS pins)](https://nvd.nist.gov/vuln/detail/CVE-2026-100551), NIST NVD
- [CVE-2026-85105 (Hermes Agent session management)](https://nvd.nist.gov/vuln/detail/CVE-2026-85105), NIST NVD
- [Running OpenClaw safely](https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely/), Microsoft Security Blog
- [Hermes vs OpenClaw](https://www.dhawalshah.net/article/hermes-vs-openclaw/), Dhawal Shah
- [User comment comparing OpenClaw and Hermes, 5 October 2026](https://news.ycombinator.com/item?id=49960837), Hacker News
- [User comment on running Hermes on a VPS, 5 October 2026](https://news.ycombinator.com/item?id=49960457), Hacker News
- [User comment on OpenClaw for ad production, 25 September 2026](https://news.ycombinator.com/item?id=49840053), Hacker News
- [DigiSapiens](https://digisapiens.ai), DigiSapiens