OpenClaw vs Hermes Agent: is a self-hosted AI assistant safe?

You may have heard about the new personal AI assistants. You message them from a chat app, and they read your email, check your calendar, open your files, and do things on your behalf. Two open-source ones come up most: OpenClaw and Hermes Agent. "Open source" means the code is public and anyone can run it, with nobody at a company responsible for how you set it up.

Owners ask us two things. Is OpenClaw safe? And is Hermes Agent better? Short answers: OpenClaw had a bad security year in 2026, Hermes Agent looks more carefully built but is young, and neither is safe by default. Where and how you run it matters more than which one you pick. One disclosure first: we set these up for small businesses as a quoted build, and for now we default to Hermes Agent. Read the rest with that in mind. The sources are linked so you can check us.

What these assistants are

Both are "agents." A normal chatbot answers questions. An agent can act. Give it access to your mail and it can read, sort, and draft replies. Give it your files and it can look things up. Give it more permission and it can send, delete, or buy.

That's the appeal and the risk, in the same sentence. The more it can do for you, the more damage a mistake or an attacker can do with the same access. Most of what follows is about limiting that.

OpenClaw's 2026 security record

OpenClaw was widely used and fast-moving, and it's patched often. The problems below were reported by researchers and security firms in the first half of 2026. Many were fixed. Some of the numbers differ by source, and we say so.

**It listened to everyone by default.** The Cloud Security Alliance says OpenClaw binds its control panel to "0.0.0.0:18789" by default. That means it listened on every network connection the computer has, not just the computer itself. On a machine reachable from the internet, anyone could try to reach it. SecurityScorecard's research team counted exposed control panels. SiliconANGLE reported 28,663 unique addresses in 76 countries on February 9, a count that climbed past 40,000. The Cloud Security Alliance cites more than 135,000 across 82 countries. The numbers differ because the scans kept running and the counting changed. Either way, it was a lot.

**A one-click flaw.** A bug tracked as CVE-2026-25253 let a malicious web link steal the assistant's login token and take control of the machine. Broadcom's bulletin rates it 8.8 out of 10 and says it was fixed in late January 2026. Sources disagree on the exact fixed version, 2026.1.29 or 2026.1.30. A CVE is just a public ID number for a known security flaw.

**More serious ones followed.** In May, Cyera published four chained flaws, the worst rated 9.6 out of 10, which let an attacker escape the assistant's sandbox (the walled-off area meant to contain it). The patches came out April 23, 2026. Fixes land quickly. The point is that they kept being needed.

**Bad add-ons.** OpenClaw has a public library of add-ons called skills, on a site called ClawHub. Koi Security audited it and reported 341 malicious skills, most from one campaign it named ClawHavoc. Palo Alto Networks' Unit 42 repeats that figure and adds that Bitdefender found about 17% of the skills it analyzed contained malicious payloads. A third firm, Antiy, counted 1,184 on its own. The totals depend on who counted and when, so treat any single number loosely. Unit 42 also found five more malicious skills between February and May that the screening tools missed. They reported them, and the accounts were banned.

**Microsoft said not to run it on a normal computer.** In February, the Microsoft Defender team wrote that OpenClaw should be treated as "untrusted code execution with persistent credentials" and that it's "not appropriate to run on a standard personal or enterprise workstation." They advise a dedicated virtual machine or a separate device, throwaway accounts, and no sensitive data. They added that for most environments, the right call may be not to deploy it.

Fair is fair. Much of this was about exposed setups and add-ons, not only the code. Microsoft's advice is about how to run it, and the same advice applies to any agent.

Hermes Agent

Hermes Agent is from Nous Research, an AI research group. It was released in February 2026 under an open-source license. We run our own assistant on it, so we know it well, and we're not neutral.

Its security documentation lists eight layers. The ones an owner should care about:

Its record is shorter, and it's young. We did not do a full count of security reports, so we won't claim a number. We can say one thing we checked. In October 2026, release v0.21.6 on October 8 fixed four login-related issues reported by Tenable Research, including one that could let someone take over a session. If you've read that these came in September, the release page dates the fix October 8. They were found and fixed, which is how it should go, and it also shows Hermes isn't automatically safe.

One business security guide puts it plainly. Layer3 Labs says Hermes Agent can be run safely, "but it is not safe by default", and calls safety "a setup decision, not a property of the software." We agree.

• **Approvals for risky commands.** The default "smart" mode has a second AI judge each command. Low-risk ones run, clearly dangerous ones are blocked, and uncertain ones ask a person. A "manual" mode asks every time. An "off" mode turns it all off, and the docs say to use it only in trusted environments.
• **Container isolation.** Commands can run inside a Docker container (a sealed box on the computer), so a bad command can't reach the rest of the machine. In that mode the command checks are skipped, because the container is the boundary.
• **Who can talk to it.** Allowlists decide who may message the assistant.
• **Skill checks.** The docs say a feature called Skills Guard scans skill content for suspicious patterns before installation. The docs say little else on this, so we can't tell you how thorough it is.

The engine matters less than the setup

Put OpenClaw on a locked-down machine with careful add-ons, and it's a much smaller risk. Put Hermes Agent on your office laptop with full email access and approvals turned off, and it's a much bigger one. Here's the checklist we'd hold any setup to.

Keep it updated too. Both projects ship security fixes often, and an old copy misses those fixes.

One more honest limit. Unless you add AI hardware that runs models on your own machine, the assistant still sends your questions, and whatever mail or file text it needs to answer them, to a hosted AI model run by another company. A private machine keeps the assistant's tools and files at home. It doesn't make the model private. Check the data terms of the plan you use.

• **A machine you control.** A dedicated computer in your office, not your daily laptop. Microsoft says the same.
• **Never open to the internet.** No port forwarding, no public address. Reach it from a chat app through a private route.
• **Vetted add-ons only.** Someone reads each skill before it's installed. No installing from a library on trust.
• **Least permission.** Give it a separate account with only the mail, calendar, and folders it needs. Not your owner login.
• **Approval before anything that sends, deletes, or pays.** A person says yes first. Layer3 Labs recommends the same for anything that sends money, data, or messages outside your systems.
• **A log of what it did.** Plain and readable, so you can see what happened last Tuesday.
• **A person who owns it.** One named person is accountable for the setup, updates, and shutting it off.

Do you need one?

Maybe not yet. If your pile is retyping purchase orders or moving data between two programs, a single narrow automation does that with far less access than a general assistant. Start there. A personal assistant makes sense when email, calendar, and follow-ups pile up while you're on the floor, and you're ready to own the setup.

If you do want one, our private assistant build puts it on a shop server in your office, with the checklist above built in. It's a quoted build, not part of our "Pay only if you keep it" trial, which covers the smaller automations. How it works lays out the steps, and you can tell us the job when you're ready.