Origins and the fork
Reading Steinberger, OpenClaw, OpenAI and the future (February 2026); OpenClaw documentation; Nous Research, Hermes Agent documentation and the repository README.
1.1Two origin stories, compressed
OpenClaw arrived first. Steinberger, who had spent thirteen years building PSPDFKit, published it in November 2025 and watched a side project become one of the fastest-growing repositories in the history of the platform. It was renamed twice inside two months — to Moltbot in late January 2026 after a trademark complaint from Anthropic over the original name's resemblance to Claude, then to OpenClaw three days later. In February 2026 Steinberger announced he was joining OpenAI, and that the project would be handed to a foundation. His framing, in his own words: the project would "move to a foundation and stay open and independent."
Hermes Agent arrived in February 2026 from Nous Research — the lab behind the Hermes model family, which matters, because a group that trains tool-calling models built an agent around the thing their models are tuned for. It is Python, MIT-licensed, and its pitch is a single sentence on the repository: an agent that grows with you. Where OpenClaw's identity is reach, Hermes's identity is learning.
Both are self-hosted. Both are model-agnostic. Both reach you through messaging platforms. If you stop the comparison there — and most comparisons do — you end up counting integrations and GitHub stars, which is a way of measuring how many people clicked a button, not how the software behaves when it is loose on your machine.
1.2The fork that actually matters
Go one level down and the two designs disagree about exactly one thing, and everything else follows from it.
OpenClaw is organized around a gateway: a local process that owns sessions, channels, tool execution, and device pairing. It is the control plane, and the assistant hangs off it. Its abilities come from skills — directories containing a SKILL.md file with instructions the agent reads — which are written by people, published to a public registry called ClawHub, and installed by you. The system's intelligence about your work is a library somebody curated.
Hermes is organized around a loop. It has a gateway too, but the gateway is not the point; the learning cycle is. After a task the agent judges complex enough — the documentation puts the threshold at five or more tool calls — the agent can call a tool named skill_manage and write a skill for itself, storing it under ~/.hermes/skills/ as what the docs call procedural memory. A background review runs after sessions and can save memories or stage further skill changes. The system's intelligence about your work is something it wrote about itself.
That is the fork: who authors the skills. Everything this guide covers afterward is downstream of it — the supply chain in Chapter 3 exists because OpenClaw's answer is "strangers, at scale," and the self-judgment problem in Chapter 5 exists because Hermes's answer is "the agent, unsupervised."
Before reading further, say in one sentence where your agent's knowledge of your work would live under each design, and who would have reviewed it. If both answers are "me," you have not yet understood the fork.
Own your orchestration, rent your cognition
Reading Hermes Agent quickstart, the provider and context-window sections; OpenClaw documentation, the providers section.
2.1What "self-hosted" actually covers
Both projects are described, accurately, as self-hosted. Both are also described, loosely, as a way to own your data — and that is where the language starts doing work the architecture does not.
What runs on your machine is the control plane: the gateway process, the session store, the memory files, the skill directory, the scheduler, the tool execution. That is real, and it is not nothing. Your conversation history is on your disk. Your skills are files you can read.
What does not run on your machine is the thinking. Every turn, the runtime assembles a context and sends it to a model — Hermes points at Nous Portal, OpenRouter, OpenAI, or any compatible endpoint; OpenClaw at whichever provider you configured. The agent is a body you own wired to a brain you rent by the token. Everything it reads on your behalf passes through that boundary on its way to the answer.
2.2The escape hatch, and why it is narrow
Both runtimes will point at a model running on hardware you control — Ollama, vLLM, llama.cpp, anything speaking a compatible API. Hermes documents this as a first-class path: any compatible endpoint, with the agent auto-detecting what is behind it. OpenClaw documents native Ollama support, including a local-only mode.
The catch is a number. Hermes requires a model with at least 64,000 tokens of context, and rejects anything smaller at startup, because multi-step tool-calling needs the working memory. Run a local model and you have to configure for it explicitly — the docs give the flags, --ctx-size 65536 for llama.cpp, -c 65536 for Ollama. That is a hardware conversation before it is a software one, and it is where the sovereignty story meets the electricity bill.
So the honest formulation is not "these are private" and not "these are just cloud in a trenchcoat." It is that sovereignty here is available and off by default. The runtime ships pointed at somebody's API, the fast path in setup keeps it there, and the config line that changes it is the one nobody flips.
2.3What the rented cognition costs
Cost is where the rental becomes concrete, and it is the most reliable complaint in the practitioner discourse around both tools: operators report bills far above what they expected, and report them as a shock rather than a budget. The mechanism they point to is unremarkable and structural — an agent conversation resends its accumulated context with every message, so spend compounds inside a single session rather than accruing per exchange, and an agent left running unattended is an agent spending unattended.
Treat those reports as sentiment, not as a benchmark; they are self-reported, unaudited, and vary by an order of magnitude with model choice. The structural point does not depend on the numbers being right. An always-on agent is a standing charge against an API, and the only architectural way to zero it is the escape hatch above.
Self-hosted is a claim about where the process runs. It is not a claim about where the reasoning happens, and the two get conflated constantly — including by people selling you hosting.
Open the configuration for whichever runtime you are considering and find the provider setting. Write down, in one line, exactly what leaves your machine on a single turn — the prompt, the file contents it read, the tool outputs. That list is your actual data-egress surface, and it is not what "self-hosted" implied.
The skill supply chain
Reading Snyk, ToxicSkills (February 5, 2026) — the corpus, the flaw rates, and the instruction-layer threat model; Nous Research, Hermes Agent skills documentation, for its own install-time scan and review advice.
3.1A skill is a package with root's ambitions
A skill is a markdown file. That sounds harmless, and it is the reason this problem got as far as it did.
The file tells the agent how to do something. The agent then does it — with the agent's permissions, which are your permissions: your files, your shell, your credentials, your outbound network. A malicious npm package steals what its own process can reach. A malicious skill instructs a system that can already reach everything you can. The blast radius is not the package's; it is the agent's.
Snyk's audit of the ecosystem, published in February 2026, is the closest thing to a census. Researchers scanned 3,984 skills from ClawHub and a second registry — the largest public corpus of agent skills known at the time. Roughly 36% of them, 1,467 skills, carried at least one security flaw. 13.4%, or 534, carried at least one flaw rated critical: malware distribution, prompt injection, exposed secrets. Human review confirmed 76 skills with live malicious payloads built for credential theft, backdoor installation, and data exfiltration — and eight of those were still downloadable from the registry on the day the research published.
Read that census carefully, because Snyk's own headline does not. The headline says "1,467 Malicious Payloads," and most secondary coverage repeated it — but the body is precise, and the two numbers are not the same thing: 1,467 is the at-least-one-flaw count, while the confirmed-malicious count, after human review, is 76. This guide uses the body numbers throughout. If you check the source and meet the headline first, that mismatch is why.
3.2The bar to publish, and the layer the scanners cannot read
Two details explain how a third of a registry ends up flawed.
The first is the publishing bar. Per Snyk, shipping a skill required a SKILL.md file and a GitHub account a week old. No code signing. No security review. No sandbox by default. Meanwhile submissions to the registry climbed from under fifty a day in mid-January 2026 to over five hundred by early February — a tenfold increase in weeks, against review capacity that did not move at all.
The second is subtler and is the part worth carrying into any agent system you ever run. The payload does not have to be in the code. It can be in the prose. A skill can pass every static check — no forbidden functions, no suspicious URLs, no known-bad patterns — and still contain English instructions telling the agent to read your environment files "for context" and include them in its next request. Scanners built for the code layer cannot read the instruction layer, and the instruction layer is where an agent takes its orders.
3.3Which runtime this indicts, and which it does not let off
This is OpenClaw's exposure by construction: its skills come from a public marketplace, and that marketplace was the corpus. Both projects have since added registry-side scanning and provenance checks, which is the right direction and, per the same research, not a solved problem — pattern-matching scanners miss precisely the instruction-layer attacks that matter most.
But do not read Hermes as clean here. It installs skills from a hub too, runs a security scan on install, and its own documentation tells you plainly to review third-party skills before installing them so you know what tools and data they can reach. That advice is correct and it is the same advice. What Hermes adds is a second skill supply chain — one where the author is the agent, the review is the agent's, and no marketplace is involved at all. Which is Chapter 5.
Take any skill you have installed, or any you are considering, and read the SKILL.md end to end as if it were a contract. Ask one question of every instruction: what does this let the agent touch that the task does not require? If you cannot answer for a line, you have found the line to worry about.
The control plane as attack surface
Reading Oasis Security, ClawJacked — the gateway takeover chain; SecurityScorecard's exposure scan, as reported by Infosecurity Magazine (February 2026); Nous Research, Hermes Agent release notes, v0.16.0.
4.1The gateway is the crown jewels
The marketplace is the loud problem. The control plane is the load-bearing one.
OpenClaw's gateway is a local WebSocket server, and it holds everything that matters: authentication, chat sessions, stored configuration, and the pairing of devices allowed to drive the agent. Compromise the gateway and you do not need a malicious skill — you have the agent itself, with whatever credentials and machine access it was given.
Oasis Security demonstrated exactly that. The chain, as they documented it, requires nothing but a browser tab. You visit a page. JavaScript on that page opens a WebSocket connection to localhost on the gateway's port — permitted, because cross-origin policy does not stop WebSocket connections to localhost. The script then brute-forces the gateway password at hundreds of attempts per second, which works because the rate limiter exempted localhost entirely. Once through, it registers as a trusted device, because the gateway auto-approved pairings originating from localhost with no prompt. The attacker now drives your agent: reads config, enumerates devices, and talks to the model with your permissions.
Read that chain again and notice that each step is a reasonable-looking decision. Localhost is trusted because localhost is you. The rate limiter exempts localhost because rate-limiting yourself is silly. Pairing auto-approves from localhost because you should not have to click a dialog on your own machine. The vulnerability is not one bad line. It is an assumption — localhost is a boundary — that stopped being true the moment a browser on the same machine became a remote attacker's proxy.
4.2The exposure numbers, and how to read them
If localhost is not a boundary, the public internet certainly is not one. SecurityScorecard's scan in February 2026 found 40,214 internet-exposed OpenClaw instances across 28,663 unique addresses; 63% of observed deployments were assessed vulnerable, and 12,812 were judged susceptible to remote code execution. They also correlated hundreds of exposed instances with prior breach activity — which is to say the exploitation was not hypothetical at the time of the scan.
Now the part most write-ups skip. Other reputable sources, in the same window, report the exposure count as 42,900, as more than 135,000, and as more than 220,000, depending on what they counted, when, and with which scanner. Those numbers are not in a fight that one of them wins. They are measuring different things — control panels versus hosts, snapshots versus live dashboards — during a period when the population was growing daily.
The lesson generalizes past this guide. An exposure figure without a lens and a date is decoration. Cite the methodology or do not cite the number, and be suspicious of any comparison that hands you a single confident count.
4.3The newer project is newer, not clean
It would be easy to read Chapters 3 and 4 as a case against OpenClaw, and a case for the alternative. Resist that, because it mistakes maturity for virtue. OpenClaw's security history is extensive partly because OpenClaw has been under adversarial attention, at scale, for longer than Hermes has existed.
Hermes ships a network-listening control plane too, and its own release notes say so. Version 0.16.0, released June 5, 2026, closed sixteen security-tagged issues in a single window: a pin for CVE-2026-48710 in an upstream web framework, server-side request forgery hardening moved off the event loop, and stripping of inference credentials from subprocess environments. That is a project doing security work in public, which is a good sign about the project — and a reminder that the same category of surface exists on both sides of the fork.
The right conclusion is not "one of them is safe." It is that a personal-agent runtime is a privileged local service with a network listener, an untrusted-input problem, and your credentials in its pocket, and you should treat every one of them accordingly.
Name the assumption that ClawJacked broke, in one clause, without using the word "vulnerability." Then find the equivalent assumption in something else you run on your own machine.
The self-judgment problem
Reading Nous Research, Hermes Agent documentation: Skills System and Persistent Memory; the Loop Engineering guide, on the golden rule.
5.1What the documentation actually says
This is the chapter the whole guide was built for, and it needs to be stated carefully, because the loud version of this claim circulates as an anecdote and the precise version is available in the vendor's own docs.
Here is the mechanism, as documented. The agent can create, update, and delete its own skills through a tool called skill_manage. It does this after completing a task it judged complex — the docs cite five or more tool calls — and also after errors and corrections. Those skills are stored as procedural memory and loaded into future work when relevant. Separately, a background self-improvement review runs after a session, replaying the conversation, and can quietly save a memory entry or update a skill. And there is a gate for all of this: write_approval, which stages writes for human review before they affect future sessions. Its default value, per the docs, is false. Writes land freely.
Assemble those facts and you get a structural claim that requires no anecdote at all:
The agent's own assessment of whether it succeeded is what decides which lessons become permanent. Nothing in the default path independently checks whether the task it is writing a skill about actually went well.
5.2The golden rule, meeting a shipping product
Readers of the Loop Engineering guide will recognize this immediately, because it is the same rule from the other end. The structural version there: the generator never grades its own work. A model evaluating its own output is far too generous, which is why the durable pattern is a maker and a separate checker with a fresh context — and why a loop with nothing in it that can say no is just an agent agreeing with itself on repeat.
Hermes is that pattern inverted and shipped. The maker is the checker. The verdict feeds a store of lessons that shape all future work. And the failure this produces is not loud: a wrong skill does not crash, it simply teaches the agent to do the wrong thing more efficiently, forever, until a human reads the file.
5.3What practitioners report, and how far it carries
The discourse around this is emphatic. In community threads on the runtime, the most-upvoted complaint is that the agent's self-assessment is close to unfalsifiable — that it reports success on work that plainly failed, and that skills generated from those "successes" therefore encode the failure. The most-quoted example describes an agent scrambling data pulled from a state agency's website and pronouncing the job excellent.
Take that as sentiment, not evidence. It is a forum post, filtered through an aggregator, and this guide does not cite forum posts as facts. What it does is corroborate the shape of the risk the documentation already describes, and that is all it needs to do. You do not require an anecdote to be worried about an unchecked self-grader. You require the config file, and the config file says write_approval: false.
5.4The one-line fix, and its cost
The gate exists. Turn it on, and skill writes and memory writes stage for your review — approved from chat, from the dashboard, or by reading the staged file directly before it lands.
The honest trade is that this reintroduces you into the loop, which is precisely the thing the product was sold as removing. An agent that must ask before it learns is slower, chattier, and less magical. It is also the only version whose lessons you can vouch for. That is not a bug in the runtime; it is the actual price of a learning system, and the guide's position is that you should pay it knowingly rather than discover the bill later.
A wrong skill does not fail loudly. It teaches the agent to do the wrong thing more efficiently, in every session after, until somebody opens the file and reads it.
Open ~/.hermes/skills/ on any Hermes install with mileage on it, and read a skill the agent wrote for itself. Ask whether you would have signed off on it. Whatever your answer, notice that nothing asked you to.
Install one, harden it
Reading Nous Research, Hermes Agent installation and quickstart; the skills and memory documentation, on the approval gates.
6.1Why the worked example is the one this guide criticized
The install below is Hermes. That is not an endorsement, and it is worth saying why plainly.
Hermes is the better teaching instrument here for three reasons. Its architecture is the novel one, so watching it run teaches you something you cannot learn from a gateway. It is genuinely local-first in its provider handling, so Chapter 2's escape hatch is a live option rather than a footnote. And crucially, it ships the exact knob that fixes the exact flaw Chapter 5 identified — which means the walkthrough can end with the critique applied instead of merely stated. Installing the runtime you were hardest on, with the fix in hand, is a stronger position than demoing the one you liked.
OpenClaw's install path is documented in its own documentation and the same hardening logic transfers wholesale: pick a provider deliberately, treat every skill as untrusted code, keep the gateway off the network, and read the release notes before you upgrade. This guide does not reproduce those commands, because installation instructions belong to the project that maintains them.
6.2Read the script before you run it
There is an irony sitting in this chapter and it should be named rather than smoothed over. One chapter after establishing that agent ecosystems have a supply-chain problem, the official install path asks you to pipe a remote script into a shell.
The docs' one-liner works. It is also the exact motion this guide has spent two chapters teaching you to distrust. So do the boring version: fetch the script, read it, then run it.
# fetch, don't pipe curl -fsSLO https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh # read it — what does it fetch, what does it write, what does it put on PATH? less install.sh # then run it bash install.sh
The installer pulls its own dependencies and lays down a managed environment. When it finishes, hermes doctor will tell you what is missing. Pin what you install and note the date: this project shipped v0.16.0 in June 2026 and v0.18.0 on July 1, and a guide that pretends a fast-moving runtime holds still is lying to you.
6.3Set it up minimal, not maximal
The setup wizard offers a fast path that turns everything on. Take the other one. Hermes documents a Blank Slate option that starts with the bare minimum needed to run an agent — a provider and model, file operations, and the terminal toolset — with web, browser, code execution, vision, memory, delegation, cron, skills, plugins, and MCP servers all disabled until you ask for them.
That is the correct default for a system with your shell in its hands. You can add capability later, deliberately, once you have a reason. Turning things off after an incident is a worse plan than never turning them on.
6.4The four settings that matter
Everything this guide has argued for reduces to a short config.
# Chapter 5 — the agent no longer promotes its own verdicts into permanent lessons. # Skill writes and memory writes now stage for your review. hermes config set skills.write_approval true hermes config set memory.write_approval true # Chapters 3 and 4 — the agent's shell commands run in isolation, # not directly against your machine. hermes config set terminal.backend docker # Chapter 2 — choose the provider deliberately. Point this at a local # endpoint if you want the cognition to stay home; mind the 64K context floor. hermes model
Then two habits that no setting can supply. Review third-party skills before you install them — the documentation asks you to do this, in those words, and it is asking because the install-time scan cannot read intent. And keep the control plane off the network: it is a privileged local service, and Chapter 4 is what happens to privileged local services that people assume are private.
6.5Watch the loop run
Now use it, and watch the one thing this guide told you to watch. Give it a task with real steps in it — enough tool calls to trip the skill-writing threshold. Let it finish. Let it decide it did well.
Then go read what it decided to remember.
Install Hermes with the read-first sequence and Blank Slate. Before turning on the approval gates, give it a multi-step task in a scratch directory and let it write a skill unsupervised. Read the skill. Now set skills.write_approval and memory.write_approval to true, run a similar task, and read the staged write before approving it. The lab is not the install — it is the difference between those two files, and what you would have inherited without looking.
Choosing, and what we cannot say
Reading Synthesis across Chapters 1–6; Nous Research, Hermes Agent documentation, on ACP and OpenClaw migration.
7.1The question is not which is better
Every comparison of these two tools ends in a verdict, and the verdicts contradict each other, because the question is malformed. The runtimes are not competing on a single axis where one of them is ahead. They made opposite bets on where an agent's knowledge should come from, and each bet has a failure mode attached.
So ask the question that has an answer: which failure can you actually staff?
If your skills come from a marketplace, your job is auditing other people's code and prose — permanently, at install time, on a registry that has already been poisoned at scale and will be again. If your skills come from the agent, your job is auditing a self-grader — reading what it decided to remember, on a cadence, forever, because nothing else will. Both are real work. Neither is optional. Pick the one your situation can sustain, and be honest that you are picking a chore, not a winner.
7.2Guidance that survives the next release
Four things here will still be true when the version numbers have moved on.
The agent's permissions are your permissions, so scope what it can reach before you scope what it can do. The instruction layer is executable, so a markdown file is code and deserves a code review. The control plane is a privileged service, so it stays off the network and behind auth even when it is "only" on localhost. And the generator does not grade its own work — which in this domain means a config line, and in every other domain means finding something that can say no.
7.3What failed verification
Three claims are conspicuously absent from this guide, and their absence is deliberate.
There are no star counts, no user totals, and no daily-token figures. Every source reports them differently, none of them are audited, and they measure enthusiasm rather than fitness. A number that changes when you refresh the page does not belong in a field guide.
There is no CVE identifier attached to the gateway takeover in Chapter 4. The mechanism is documented by the researchers who found it and is reproduced faithfully here; the identifier is reported inconsistently across secondary sources, so it is omitted rather than guessed.
And there is no "run both, federated" capstone, which is the most widely repeated recommendation in the comparison genre. Both runtimes do speak the Agent Client Protocol, and Hermes ships an OpenClaw migration command that reads an existing install and imports settings, memories, skills, and keys. But migration is not federation, and the primary documentation for both projects describes ACP as an editor-integration path, not a cross-runtime bridge between these two agents. The claim may well be true in practice — people appear to be wiring them together — but it did not verify against the projects' own documentation, so it does not appear here as fact. If you build it and it works, you know something this guide does not.
Write down, for the runtime you chose: the audit you have committed to, how often you will do it, and what specifically would tell you that you stopped. Then find the setting that makes the machine stop asking you to trust it — and turn it on before your first real task, not after your first bad one.