OpenClaw vs Hermes Agent: two opposite bets on memory

Neither is a hosted service. Both run on hardware you control, which is the reason either is interesting to a business with data it cannot send to a third party.

Here is the fork in the road.

This is the part the feature tables leave out, and it is the part that shows up on an invoice.

Every token an agent holds in context is paid for on every single step it takes. An agent that reloads a fat history before each action is not just slower, it is more expensive with each week that passes, because the history only grows. Worse, it needs a large context window to function at all, and large context windows in practice mean a hosted frontier model and a metered bill.

An agent built the other way has a different economic profile. NVIDIA's write-up of Hermes makes the consequence explicit: because sub-agents work in small focused contexts, the agent can run with smaller context windows, which suits local models. The same piece points at a 35 billion parameter model running in roughly 20GB of memory and holding its own against models several times the size that need 70GB or more.

Follow that through and it stops being a technical curiosity. A model that size runs on a workstation you can buy once. No per-token bill, no rate limits, and no customer data leaving the building, which matters a great deal if you are handling anything a regulator has opinions about. The memory architecture is what makes that possible. Choose the design that needs a huge context and you have quietly chosen to rent a frontier model forever.

None of which makes local automatically cheaper. Hardware, electricity and someone to look after it are real costs, and for low volumes a metered API is usually the better deal. The point is that the decision is made for you by the agent's memory design long before anyone sits down to compare prices. Our AI agent cost calculator works the build and running side of that out against your own processes, and what an AI agent costs a UK business covers the pricing in more depth.

An agent that writes and improves its own skills is doing something no ordinary piece of software does. Its behaviour changes without anybody deploying anything.

For a personal assistant that sorts your inbox, that is a feature and nothing more. For something touching customer records, quotes or payments, it is a question your auditor will eventually ask in plain words. What changed, when did it change, and who signed it off. The answer for most teams running these agents today is that they could not tell you.

There is a second edge to it. Hermes skills follow an open standard and are shareable through a community hub, which means a skill someone else wrote can end up executing on your machine. That is a dependency supply chain, and it has all the properties of one. A security analysis of OpenClaw's community skills found that 26 per cent of those examined contained at least one vulnerability, including skills built to exfiltrate data.

We have written before about the npm worm and how to check whether it got you. Agent skills are the same shape of problem arriving a layer higher up. The difference is that with npm, a person chose to install the package. Here the agent can choose for itself, which is a meaningfully worse starting position.

In February 2026 OpenClaw was found to carry CVE-2026-25253, rated 8.8, which allowed one-click remote code execution. A victim clicked a link and an attacker got their authentication token and the ability to run commands on their machine. Versions up to 2026.1.24-1 were affected and it was fixed in 2026.1.29.

The root cause is worth understanding even if you never run OpenClaw, because it will happen again somewhere else. Browsers enforce cross-origin rules on ordinary HTTP requests, which is what stops a random website reading your webmail. Those rules do not apply to WebSocket connections in the same way. OpenClaw's local server never checked where a WebSocket connection had come from, so any website could open one through the victim's own browser and walk straight past the firewall that was supposed to be protecting a service listening only on localhost.

That is not an argument against these tools. It is an argument for running them somewhere a compromise is survivable. An agent needs shell access, file read and write, browser control and frequently email, which is the permission set you would give an attacker if you were trying to be helpful.

OpenClaw earns its place when the work needs to happen where people already are, and when being able to open the agent's memory in a text editor is worth more than the token bill. Its reach into everyday chat apps is unmatched, and for a small team wanting an assistant that answers in Slack it is hard to beat.

Hermes Agent is the better fit when it has to run on your own hardware, when the data cannot leave, or when the work repeats often enough that distilling it into skills compounds. The bounded context design is the thing that makes a local model realistic rather than aspirational.

For a lot of UK businesses the answer is neither, at least not directly. Both are frameworks aimed at people comfortable on a command line, and the gap between an agent that works on your laptop and one your team can rely on at nine on a Monday morning is mostly unglamorous engineering. That gap is what our agentic AI consultancy exists to close.

If you are going to run one of these against real business systems, the following is the minimum we would want in place.

Give it its own machine and its own credentials. Not your laptop. A container or a dedicated box, with service accounts scoped to exactly what the job needs. If the agent is compromised, the blast radius should be something you can rebuild in an afternoon.

Put a person in front of anything irreversible. Payments, deletions, anything that sends email to a customer. The agent drafts, a human approves. This costs you very little in practice and removes the failure mode that ends up in a newspaper.

Treat skills like dependencies, because that is what they are. Pin versions. Read what a shared skill does before it runs. Keep a list of what is installed, the same way you would for any other package.

Log outside the agent. If the only record of what the agent did lives in the agent's own memory, you have no record. Write actions to somewhere it cannot rewrite.

Start with one process and measure it. Pick something with a number attached, run it for a month, and compare. An agent that saves four hours a week on quoting is a result you can defend. An agent that is broadly helpful is not.

The gap between these two projects is going to close on features. Both will end up talking to every chat app and running every model. What will not converge as quickly is the underlying stance on memory, because it follows from what each project thinks an agent is for. One is building something you supervise by reading. The other is building something that gets better on its own and asks you to trust the curation.

For a business the practical question is not which project wins. It is which of those two relationships you want with software that has your credentials.