Hermes vs OpenClaw: Which Agent to Self-Host

Hermes vs OpenClaw is a choice between two free, MIT-licensed agents you run on your own machine or server, so the real question is which one you can secure. For most Australian businesses we’d start with Hermes Agent, because its approval and access defaults are stricter out of the box, and only choose OpenClaw if you need its larger plugin ecosystem and are prepared to lock it down yourself.

TL;DR: Hermes Agent (Nous Research) and OpenClaw (the OpenClaw Foundation) do the same job: an always-on assistant that reaches you through chat apps and acts on your behalf. Hermes ships with risk-checked approvals on by default; OpenClaw runs tools on the host unless you turn sandboxing on, and its ClawHub marketplace has already been used to distribute malware. Self-hosting in Sydney is cheap. Doing it safely takes a separate server, least-privilege accounts and a clear answer on where your model provider sends your data.

Australians searched “hermes agent” about 12,100 times in September 2026 (our keyword data), and both projects have hundreds of thousands of GitHub stars. None of that tells you whether either is fit for a business holding customer records. Our OpenClaw explainer covers what OpenClaw is, and our comparison of always-on agents covers the managed alternatives. This piece is the head-to-head, plus the harder call on whether to self-host at all.

Hermes vs OpenClaw, side by side

Both connect a large language model to your chat apps, give it tools (a terminal, a browser, files) and let it run scheduled jobs. They part ways on safety defaults and extensions.

Two rows matter more than the rest.

The first is defaults. Hermes’ security guide sets approvals to “smart”: an auxiliary model judges risk, dangerous commands are auto-denied and uncertain ones come to you. A hardline blocklist stops catastrophic commands even with approvals off, and if no messaging allowlist is configured, every user is denied. OpenClaw’s sandboxing docs say plainly that sandboxing is off by default, and its security page treats one gateway as one trust boundary, “not a hostile multi-tenant security boundary”. Neither position is wrong. OpenClaw assumes a capable operator; Hermes assumes you might not be one.

The second is extensions. In February 2026 Koi Security audited 2,857 skills on ClawHub and found 341 malicious ones, 335 of them from a single campaign it named ClawHavoc that delivered the Atomic macOS Stealer, as reported by eSecurity Planet. Days later OpenClaw began scanning every ClawHub skill with VirusTotal, and its own announcement concedes that “a clean scan doesn’t mean a skill is safe.” We treat any third-party skill, on either platform, like an unsigned executable from a stranger, because that is what it is.

Should you self-host an AI agent in Australia?

Self-hosting gets sold as the privacy option. It is only half of one. A server in Sydney keeps the agent, its memory and its logs onshore, but every prompt still goes to whichever model provider you configure. If that is an API in the United States, the customer email your agent just summarised has left the country.

That matters under the Privacy Act. Under APP 8 and section 16C, a business covered by the Act that discloses personal information to an overseas recipient must, unless an exception applies, take reasonable steps to ensure the recipient doesn’t breach the APPs, and it stays accountable if the recipient does. The OAIC’s guidance on commercially available AI products goes further, recommending as best practice that organisations don’t put personal information, particularly sensitive information, into publicly available generative AI tools.

You have three options. The first is a local model through Ollama, so nothing leaves the building. The catch: Hermes needs at least 64,000 tokens of context for tool use, Ollama’s default is 4,096 tokens on machines with less than 24 GB of VRAM, and in our experience the open models that fit on office hardware are weaker at multi-step agent work than frontier APIs. The second is a cloud provider where you pick the region (Hermes supports AWS Bedrock and Azure AI Foundry), after confirming your chosen model is offered in Australia. The third is an offshore API with the APP 8 work done properly, starting with our AI vendor data privacy checklist. Our piece on sovereign AI in Australia covers when full onshore processing is worth paying for.

Most businesses tick boxes in both columns. That is the point where an outside view earns its fee. Our AI Quick-Win Audit is a $2,950 flat-fee working session that maps one or two high-friction workflows, ranks the opportunities by estimated time and dollar impact, and includes a live working demonstration of one of them. It starts with a free 30-minute fit call.

A safe setup checklist for either agent

We wouldn’t let an agent touch anything real until every item below is done. The list borrows from the Australian Signals Directorate’s Essential Eight, particularly restricting administrative privileges, patching and backups.

1. Separate machine or VM. Hermes’ own guide says “for maximum security, run the gateway on a separate machine or VM”. Never the laptop that holds your email and banking.
2. Container backend on. Hermes’ Docker backend or OpenClaw’s sandbox. Hermes caps each container at 5 GB of memory by default, so lower `container_memory` on a small server.
3. Least-privilege accounts. A non-root user, a dedicated email or Slack account for the agent, read-only drive access to begin with.
4. Approvals on. Hermes on “smart” or “manual”, never “off” outside a throwaway container. In OpenClaw, deny `exec` with a tool policy unless the job needs it.
5. No production credentials. No admin tokens, payment accounts or customer database passwords in the agent’s environment.
6. Allowlists for who can message it. Both tools support pairing codes and allowlists. A bot anyone can DM is an open door.
7. No unvetted skills. Read the source of any third-party skill first, or write your own.
8. Logging and review. Keep the logs (Hermes writes to `~/.hermes/logs/`), run `openclaw security audit`, and have a named person review them weekly.
9. Patch monthly. `hermes update` or the latest OpenClaw release, plus operating system updates.

The National AI Centre’s Guidance for AI Adoption adds the governance layer: clear roles, an AI register and human oversight. For an agent, that means one accountable owner and a written list of what it may do without asking. An agent a staff member installs without approval is a textbook case of shadow AI.

What it costs to run

The software is free. The server and the model are not. Prices checked on 26 October 2026 against BinaryLane’s VPS pricing and Anthropic’s API pricing.

A Sydney-hosted BinaryLane server with 2 vCPUs and 4 GB of memory is A$19.60 a month ex GST (A$21.56 inc GST). We’d pay that over the A$9.80 ex GST 2 GB plan to leave room for Docker. AWS Sydney (ap-southeast-2) and Azure Australia East make sense if you already run there.

The model bill is where scheduled checks bite. This is an illustrative example, not a quote: assume a check every 30 minutes (OpenClaw’s default interval), each sending 20,000 input tokens of context and returning 500 output tokens, on Claude Sonnet 5.5 at US$2 per million input tokens and US$10 per million output tokens:

• 48 checks a day x 30 days = 1,440 checks a month
• Input: 1,440 x 20,000 = 28.8 million tokens, at US$2 per million = US$57.60
• Output: 1,440 x 500 = 0.72 million tokens, at US$10 per million = US$7.20
• Total: US$64.80 a month, before the agent does any real work

Every two hours, the same arithmetic gives 360 checks: US$14.40 plus US$1.80, or US$16.20. Prompt caching would cut both figures. Set the schedule on purpose.

One trap for Claude subscribers: since 4 April 2026, third-party tools such as OpenClaw connected to a Claude subscription draw from paid extra usage rather than plan limits, as InfoWorld reported. Budget for an API key instead. Hermes users can also choose Nous Portal, whose Plus plan is listed at $20 a month with $22 of monthly credits (the page shows no currency; Nous Research is a US company).

Our verdict

On Hermes vs OpenClaw, we’d pick Hermes Agent for a first self-hosted agent in an Australian business, because its defaults fail closed and its own documentation pushes you towards isolation. OpenClaw has the larger community and plugin ecosystem, and it suits a technical team that will configure sandboxing and tool policy on day one. Neville has spent more than 20 years leading digital transformation programs for organisations including NSW Government, Telstra and Woolworths, and his view is blunt: the software is rarely what goes wrong. The boring setup work around it decides whether an agent is safe, so do that first.

If you’d like a second opinion before you install anything, our Technology Assessment and AI Agent Development work sits within our AI and automation practice and our strategy and advisory practice. The fastest way in is the AI Quick-Win Audit: the fee is credited in full toward any project of $10,000 or more commissioned within three months. Or get in touch and tell us what you want the agent to do.

Frequently Asked Questions