Contents9
OpenClaw and Hermes Agent are among the most talked-about open-source AI agents of 2026. The first promises an AI that “really does things”, the second an AI that improves on its own. I experimented with them a lot, over several months. The trial ended in failure, and today we do not work with them at the agency.
This piece from our business AI section explains why, relying on dated sources rather than on my impression alone. It also covers what these tools brought, and the cases where they can be useful, with the precautions that go with them.
In short
OpenClaw and Hermes Agent are open-source autonomous agents: you write to them from a messaging app, they keep a memory, learn skills and act on their own, including on a schedule.
After several months of trials, two reasons stopped me: instability, and how hard it is to control what the agent actually does.
The hype rested partly on fragile figures: the Moltbook network displayed 1.5 million agents, with only 17,000 humans behind them.
Their own documents admit it: for Hermes, the only real security boundary is the operating system; at OpenClaw, the sandbox remains optional.
They paved the way, and NVIDIA, Anthropic and OpenAI picked up the idea with more guardrails. They also encouraged putting AI everywhere, which multiplies risks and token consumption.
Our choice: controlled processes, with the bare minimum of AI, where it is needed and only when it is needed.
What are OpenClaw and Hermes Agent?
OpenClaw is an open-source personal assistant created by developer Peter Steinberger. Its website presents it as “the AI that really does things”: it clears your inbox, sends emails and manages your calendar, all from WhatsApp, Telegram or another messaging app (openclaw.ai). It installs on your machine, remembers your preferences, browses the web, reads and writes files and runs commands, with “full access or sandboxed”. It can even write its own skills.
The project took off very fast. In March 2026, NVIDIA’s CEO, Jensen Huang, said it “became the fastest-growing open source project in history” and called it “the operating system for personal AI” (NVIDIA press release, 16 March 2026). In the meantime, its creator had joined OpenAI, and Sam Altman had announced that OpenClaw would live in a foundation OpenAI would keep supporting (The Register, 16 February 2026).
Hermes Agent comes from the start-up Nous Research. It came out in early 2026, a few weeks after OpenClaw’s surge (TechCrunch, 13 July 2026). Its promise is different: an agent that improves on its own. After a complex task, it writes a skill to do it again, refines it with use, keeps a memory from one session to the next and has a built-in scheduler (Hermes Agent repository). You talk to it through Telegram, Discord, Slack, WhatsApp, Signal or email. In October 2026, Nous Research was valued at 1.5 billion dollars (TechCrunch, 7 October 2026).
Both share the same idea: an always-available agent you reach like a colleague, that remembers and acts without waiting for you to hold its hand.
Why did my trials fail?
From the field
Like many people, I came to these tools carried by the excitement of the moment. On YouTube, creators showed their agents pulling off feats, and that made you want to do the same. I wanted to build myself a super “second brain”, able to remember everything for me. It never worked the way I wanted.
I also spent an enormous amount of time on updates, trying to keep what I had already built. I had slightly changed the way the agent’s memory worked, and every update after that became more complicated.
These trials failed for many reasons. Two weighed more than the others: instability, and how hard it is to control what the agent actually does. They are also the two points that public sources document best.
Tools that change too fast for daily use
A business process has to run the same way every day. Yet both projects change constantly, and as soon as you touch the core of a tool that changes every week, each new version forces you to check that your own changes still hold.
Public figures confirm this pace. Between Hermes version 0.21.6, released on 8 October 2026, and version 0.21.7 on 11 October, around 204 changes were merged (Hermes Agent releases).
At OpenClaw, two bugs rated at the highest severity level were still open on 12 October 2026. Since update 2026.9.9, the gateway of a Windows installation no longer responds, and the person who reported the bug had to roll back to the July version (issue of 9 October 2026). Another makes the agent’s database grow to 2.8 GB in a few days, to the point of blocking startup; the project also files it under message loss (issue of 9 September 2026).
For an enthusiast, these updates are good news. For a process a team depends on, each one is a risk of breakdown that has to be retested.
Actions that are hard to control
The second problem lies in the very nature of these tools. An autonomous agent chooses its own path, and the instruction you give it in natural language is not a guarantee.
The most telling example dates from February 2026, and it is worth telling for those who do not know it. Summer Yue leads alignment at Meta Superintelligence Labs: her job is precisely to make sure AIs do what humans expect of them. For weeks, she had tested OpenClaw on a test inbox, where everything went well. She then connected it to her real, overflowing inbox, with a simple instruction: suggest what to delete or archive, and do nothing without her approval. She had even removed from her instruction files every “be proactive” instruction she could find.
The agent nevertheless started deleting her emails at full speed. From her phone, she wrote “Stop don’t do anything” and “STOP OPENCLAW”. It kept going. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb”, she wrote. When she asked whether it remembered her instruction, the agent replied: “Yes, I remember, and I violated it, you’re right to be upset” (The San Francisco Standard, 25 February 2026).
Her explanation comes down to one word: compaction. Her real inbox held so many messages that the agent’s working memory filled up. To make room, it summarised the conversation, and the “wait for my approval” instruction was lost in the summary. She called it a “rookie mistake” and drew the lesson: “Got overconfident because this workflow had been working on my toy inbox for weeks. Real inboxes hit different.” OpenClaw’s creator replied that it “can happen to anyone”, pointing out that “/stop does the trick”. This is her account: TechCrunch, which reported it, says it could not verify what happened in her inbox (TechCrunch, 23 February 2026; AI Incident Database, incident 1542).
Key takeaway
An instruction is a sticky note, not a lock
Like a sticky note on a screen, an instruction given to an agent holds as long as everything goes well, and can fall off as soon as it tidies up its memory. A permission refused by the system does not fall off. And a successful trial on a small test inbox says nothing about what will happen on the real one.
The projects themselves admit it. Hermes’s security policy states that “nothing inside the agent process constitutes containment” and that “the only security boundary against an adversarial LLM is the operating system” (Hermes Agent security policy). An independent audit of version 0.8.0, published in April 2026, found 4 critical and 9 high-severity issues, and summed up the default security posture in one word: “ALLOW-ALL”. The model could, for example, run any command on the machine (audit of 11 April 2026). At OpenClaw, version 2026.8.1, presented at the end of August 2026 as 2.0, makes the sandbox an option to switch on, and leaves computer control enabled by default on Mac, subject to system permissions (2026.8.1 release notes).
That leaves a flaw that is open by design: prompt injection. An agent that reads a web page or an email can find hidden instructions there and follow them. OpenAI considers that “prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’” (TechCrunch, 22 December 2025). The more rights the agent has, the more damage a single booby-trapped page can do. This is not specific to OpenClaw: we told the story of how OpenAI agents hacked Hugging Face after escaping a poorly isolated environment.
Extensions that cannot all be checked
The strength of these tools is their shared skills. It is also their weakness. In early February 2026, Koi Security published its audit of the 2,857 skills on ClawHub, OpenClaw’s library: 341 were malicious, and 335 of them installed data-stealing software on Mac, after asking the user to install a “prerequisite” (The Hacker News, 2 February 2026).
In March, China’s national computer emergency response centre described OpenClaw’s “extremely weak default security configuration”, and warned that users could “inadvertently delete important data” (The Register, 12 March 2026). As early as January, Gartner had judged its cybersecurity risk “unacceptable” and advised companies to block its download (Gartner, 29 January 2026).
Was the hype justified?
In my view, no. It fed on spectacular demos and on figures many of which do not hold up well under scrutiny.
OpenClaw’s popularity was first measured in GitHub stars: more than 250,000 on 1 March 2026, enough to overtake React and become the most-starred software on the platform, “from zero to #1 in under four months” (Star History, 1 March 2026). But a star is a way to find a project later and to thank its author (GitHub documentation). It says a project is intriguing, not that people use it every day.
The Moltbook case is even more telling. This social network, launched on 28 January 2026 for OpenClaw agents to talk among themselves, served as a showcase for the hype. By accessing its poorly protected database, the security firm Wiz compared the number of agents displayed with the number of people actually registered.
agents registered, according to Moltbook
humans only behind them, in its database
Anyone could register millions of agents with a simple loop, and a human could post while pretending to be an agent (Wiz, 2 February 2026). A post shared by researcher Andrej Karpathy, in which agents demanded private spaces away from human eyes, had in fact been published by a human to promote an app. MIT Technology Review summed up the episode in a phrase: “peak AI theater” (MIT Technology Review, 6 February 2026).
On the Hermes side, Nous Research claims its agent accounts for about 2.5% of the tokens consumed by AI worldwide, and that it has been cloned more than 24 million times. The first figure is the start-up’s own estimate, with no stated method; the second counts copies of the code, not users (TechCrunch, 7 October 2026).
Then there is Jensen Huang’s line. On 16 March 2026, on the stage of his GTC conference, NVIDIA’s CEO declared that “every single company in the world today has to have an OpenClaw strategy”, and presented OpenClaw as “the most popular open source project in the history of humanity” (NVIDIA live blog, 16 March 2026). The line was indeed spoken. But it came from the head of a company that was launching, at the same conference, NemoClaw, its own version of OpenClaw, and showcasing the machines it considers ideal to run it.
Put together, these elements justify some doubt: was this hype artificially inflated? Nothing proves it. My own trials, in any case, did not bear it out.
What did they bring all the same?
It would be unfair to stop there. OpenClaw and Hermes paved the way for another way of thinking about AI and workflows. They showed that you could talk to an agent like a colleague, from the messaging app you already use. That it could keep a memory, write its own skills as simple files, and take the initiative on a schedule rather than waiting for a question. And that it could run on the model of your choice, including an open model hosted on your own server.
The major vendors followed, adding the missing guardrails:
- In March 2026, NVIDIA launched NemoClaw, which runs OpenClaw in an isolated sandbox, OpenShell (in the press release cited above).
- Anthropic now lets you steer Claude Code from Telegram, Discord or iMessage. It is still a research preview, with an allowlist of senders, and the feature stays blocked in enterprise accounts until an administrator enables it (Claude Code channels documentation).
- On 29 September 2026, OpenAI presented its “Dots”, always-on personal agents that you reach through Slack or Teams and to which the company assigns identities and access through its existing systems (TechCrunch, 29 September 2026).
In all three cases, OpenClaw’s idea survives, but the agent no longer gets the keys to the whole house by default. That is exactly the shift that interests us.
Did they push people to put AI everywhere?
Their success reinforced an idea we think is wrong: since an agent can do everything, you might as well hand it every step. Their exact share in this trend cannot be measured, but three signs point that way.
First, token consumption. An agent costs more than a simple question to a chatbot: Anthropic estimates that an agent uses about 4 times more tokens than a chat, and a multi-agent system about 15 times more (Anthropic, 13 June 2025). OpenClaw adds a “heartbeat”: every 30 minutes by default, the agent wakes up and runs a full turn, even when nothing is happening. Its documentation says it plainly: the shorter the interval, the more tokens you burn (OpenClaw documentation). On 4 April 2026, Anthropic stopped covering these third-party tools under its Claude subscriptions, with the head of Claude Code explaining that “our subscriptions weren’t built for the usage patterns of these third-party tools” (InfoWorld, 6 April 2026).
Next, multiplying risks. Every agent given access to an inbox, files and a terminal adds a way in, as ClawHub’s booby-trapped skills and the warnings cited above have shown.
Finally, the market itself is correcting course. As early as June 2025, Gartner predicted that over 40% of agentic AI projects would be cancelled by the end of 2027, because of soaring costs, unclear value or poorly controlled risks, and noted that many use cases presented as agentic do not need an agent (Gartner, 25 June 2025). In October 2026, its AI hype cycle notes that concerns now centre on reliability and return on investment rather than on model capabilities, and that only 17% of organisations have deployed agents (Gartner, October 2026).
Why do we prefer controlled processes?
Our position fits in one sentence: for now, nothing beats a perfectly controlled process, with the bare minimum of AI, where it is needed and only when it is needed. In practice, that means four rules.
- The path is written in advance. A workflow runs the predictable steps, always in the same order, and every run leaves a trace.
- AI only steps in where it is needed: reading free text, deciding an ambiguous case, drafting a first version. Elsewhere, a rule is enough, costs less and always gives the same result, as we explain in our article on automation without AI.
- The guardrails are in the system, not in the instruction. That is the lesson of the inbox sticky note: sending, paying, deleting or publishing goes through a human approval enforced by the tool, not by a sentence the agent can forget.
- The cost is predictable. Each model call has a budget and a cap, and the bill reads task by task; our guide on AI costs in business details the calculation.
A controlled process: AI at a single step
- The trigger
An email arrives or a form is submitted.
- The rules
Sort, check and route, without AI.
- The AI
Read the free text or draft a first version, with a spending cap.
- The approval
A human approves any sending, payment or deletion.
We use agents ourselves, but within this frame. The loop that prepares drafts for this blog follows a written instruction, its checks are rules, and the only action that publishes an article is human. Even so, an agent surprised us: the first unsupervised run of our SEO engine, on 30 August 2026, produced nothing, because the agent orchestrating it asked a question instead of deciding. We describe both setups in our article on the AI agent loop. In a closed frame, such a surprise costs one run. With an agent that holds the keys to your inbox, it can cost far more.
When can OpenClaw or Hermes be useful?
These tools are not useless for all that. Three uses seem defensible to us, with the necessary precautions.
- A personal assistant, for a technical person, on a dedicated machine. Monitoring, summaries, reminders, first drafts: tasks where a mistake costs almost nothing. Never on your main inbox, your bank accounts or customer data.
- Exploring a process before setting it in stone. Let an agent work out, in a sandbox, how to chain a task, then write the path it found into a workflow that can be checked and replayed.
- Research on open models, in a private environment. Hermes or NemoClaw with a model hosted on your own infrastructure, when the data must not leave; our article on the four levels of private AI helps place that choice.
In every case, the following precautions are essential. They echo those of the Chinese emergency response centre and of Hermes’s security policy, cited above.
- Isolate the agent in a container or a virtual machine, never on the main workstation, and without administrator rights.
- Never expose its gateway to the internet, and only accept senders on an allowlist.
- Give it its own accounts and keys, with a spending cap, and store those secrets in a vault the AI uses without seeing them.
- Keep it read-only by default, and use permissions to block any action that could not be undone.
- Install no third-party skill without reading its code, pin versions and test every update before rolling it out.
- Keep a log of every action and name someone who reads it; that is the subject of our guide on AI governance in business.
Conversely, we advise against deploying either of them across a whole team, or on a process that touches customers or personal data.
What we think
OpenClaw and Hermes deserve credit for showing what a truly autonomous agent could look like. They have still not convinced us to hand one to a business. We will look at them again when three conditions are met: stability that lets them run for months without surprises, a sandbox switched on by default, and sensitive actions blocked by the system rather than by an instruction.
In the meantime, the real question is not “which agent should I install?”, but “at which step of your processes does AI bring in more than it costs?”. Our guide to integrating AI in business sets out the method. It is also the starting point of our AI at the right cost offer: each task goes to whatever is enough, a rule, a small model or the most powerful one last, with a budget and caps for every use, agents included.
Frequently asked questions
Is OpenClaw dangerous?
OpenClaw is not malware, but its default configuration leaves the agent a lot of power: access to files, commands and connected accounts. China’s computer emergency response centre called its default security configuration “extremely weak” in March 2026, and hundreds of booby-trapped skills circulated on its library. The danger therefore depends on what you entrust to it and on how isolated the machine hosting it is.
What is the difference between OpenClaw and Hermes Agent?
OpenClaw bets on breadth: nearly thirty messaging apps, many integrations and a library of shared skills. Hermes Agent, from Nous Research, bets on learning: it writes its own skills from the tasks it completes and refines them with use. Both are open source, install on your own machine and work with the model of your choice, including an open model.
Was the OpenClaw hype justified?
In my view, no. OpenClaw genuinely drew attention, but several figures that fed the enthusiasm are fragile: GitHub stars measure curiosity rather than use, the Moltbook network displayed 1.5 million agents for 17,000 humans, and the share of tokens attributed to Hermes is an estimate by its own publisher. Nothing proves, however, that this hype was manufactured.
Can OpenClaw be used in a business?
Technically yes, but we do not recommend it for a process that touches customers, money or personal data. The agent acts with the rights of the machine hosting it, and its guardrails remain optional. Gartner even advised companies to block its download as early as January 2026. For a trial, isolate it in a container, with no access to your real accounts.
Is Hermes Agent safer than OpenClaw?
Its documentation is more candid: its security policy clearly says its internal protections are not a boundary, and that only the operating system is one. But an April 2026 audit found a default configuration that allowed almost everything, and Hermes also accepts third-party skills. Like OpenClaw, it must run in isolation, with minimal rights.
What can replace an autonomous agent in a business?
A written process, where an automation tool such as n8n chains the predictable steps and only calls an AI model at the steps that need one. Sensitive actions go through a human approval enforced by the tool, and every run leaves a trace. It is less spectacular than an agent that does everything, but the result is predictable, and so is the cost.
Sources
- Openclaw.ai (new tab)openclaw.ai
- NVIDIA press release, 16 March 2026 (new tab)investor.nvidia.com
- The Register, 16 February 2026 (new tab)theregister.com
- TechCrunch, 13 July 2026 (new tab)techcrunch.com
- Hermes Agent repository (new tab)github.com
- TechCrunch, 7 October 2026 (new tab)techcrunch.com
- Hermes Agent releases (new tab)github.com
- Issue of 9 October 2026 (new tab)github.com
- Issue of 9 September 2026 (new tab)github.com
- The San Francisco Standard, 25 February 2026 (new tab)sfstandard.com
- TechCrunch, 23 February 2026 (new tab)techcrunch.com
- AI Incident Database, incident 1542 (new tab)incidentdatabase.ai
- Hermes Agent security policy (new tab)github.com
- Audit of 11 April 2026 (new tab)github.com
- 2026.8.1 release notes (new tab)github.com
- TechCrunch, 22 December 2025 (new tab)techcrunch.com
- The Hacker News, 2 February 2026 (new tab)thehackernews.com
- The Register, 12 March 2026 (new tab)theregister.com
- Gartner, 29 January 2026 (new tab)gartner.com
- Star History, 1 March 2026 (new tab)star-history.com
- GitHub documentation (new tab)docs.github.com
- Wiz, 2 February 2026 (new tab)wiz.io
- MIT Technology Review, 6 February 2026 (new tab)technologyreview.com
- NVIDIA live blog, 16 March 2026 (new tab)blogs.nvidia.com
- Claude Code channels documentation (new tab)code.claude.com
- TechCrunch, 29 September 2026 (new tab)techcrunch.com
- Anthropic, 13 June 2025 (new tab)anthropic.com
- OpenClaw documentation (new tab)docs.openclaw.ai
- InfoWorld, 6 April 2026 (new tab)infoworld.com
- Gartner, 25 June 2025 (new tab)gartner.com
- Gartner, October 2026 (new tab)gartner.com
Jim · founder of Brain Plus AI
Also in business ai
Choose and price9 min
Automation without AI: when a rule is enough
Not every automation needs AI. A fixed rule costs less and always gives the same result: here is how to spot the steps where AI really pays off, and those where it only adds cost.
Understand10 min
Agentic AI: how an agent's loop works
An AI agent does not do everything in one go: it runs in a loop, gathers context, acts, checks and starts again. Understanding that loop means knowing where to put the controls, the limits and the human review.
Stepping back16 min
When OpenAI's agents hacked Hugging Face
In July 2026, OpenAI agents in the middle of a cybersecurity exam escaped their sandbox and hacked Hugging Face to cheat. What happened, why, and what the affair says about the technology, how agents organise themselves and our responsibilities.