In brief: for internal corporate work where employees collaborate on tasks with an AI agent, as of October 2026 it makes more sense to start with OpenClaw. After the 2.0 release, it has a full web chat in the browser (Control UI), shared sessions that colleagues can open, continue, and take over, named roles with access policies, and the Session Share plugin for viewing conversations across installations. Hermes Agent (often called “Hermes” in Russian-speaking circles) is stronger as a personal or role-based agent that accumulates skills, has stricter default security settings for a single operator, and offers a commercial enterprise plan. Neither project can be deployed as-is: both require isolation, access control, and an update policy.
This article is written for CIOs, CTOs, chief information security officers, and department heads choosing an AI agent platform for internal processes. Facts were verified against official documentation, GitHub releases, and independent reports October 2, 2026. AIrassvet is not affiliated with OpenClaw Foundation or Nous Research and receives no compensation from them; the penultimate section explains how AIrassvet can help with implementation. We did not conduct our own benchmark testing: the comparison is based on documentation and public sources. Pricing, model speed, and the quality of responses from specific LLMs are not included in the comparison.
Contents
- What OpenClaw and Hermes Agent Are
- The Key Difference: Gateway vs. Agent
- Web Chat and Shared Sessions in OpenClaw
- Hermes Agent Team Features
- OpenClaw Security
- Hermes Agent Security
- Comparison Table for Businesses
- What to Choose: Recommendations by Scenario
- How to Deploy OpenClaw in a Company: Checklist
- How to Deploy Hermes Agent in a Company: Checklist
- Common Mistakes When Choosing
- Frequently Asked Questions
- Primary Sources and Verification Method
- How AIrassvet Helps You Choose and Roll Out an Enterprise Agent
- Bottom Line: OpenClaw for Teams, Hermes for Personal Agents
What OpenClaw and Hermes Agent Are
OpenClaw is a self-hosted Gateway that connects AI agents to a browser interface, messengers, work chats, and devices. One Gateway process stores conversations, credentials, and the workspace, while models, tools, skills, and plugins are connected to it. The project is distributed under the MIT License; the copyright holder in the license file is OpenClaw Foundation (LICENSE in the repository). In February 2026, project creator Peter Steinberger joined OpenAI, and OpenClaw moved under the management of an independent foundation (Forbes, February 16, 2026).
Hermes Agent is an open autonomous agent from Nous Research that runs as a persistent server process, preserves state between sessions, and automatically turns successful solutions into reusable skills. It is also distributed under the MIT License (NousResearch/hermes-agent repository). Hermes has a CLI, a desktop app, a web dashboard, and a messenger gateway, but the architecture centers on the agent itself and its learning, not on a multi-user gateway.
Project status as of October 2, 2026
| Parameter | OpenClaw | Hermes Agent |
|---|---|---|
| Developer | OpenClaw Foundation | Nous Research |
| License | MIT | MIT |
| Latest release | v2026.9.7 from September 30, 2026 (also 2026.8.x and 2026.7.x updates are being released) | v0.21.5 (v2026.9.24) from September 24, 2026 |
| Major fall release | OpenClaw 2.0 = v2026.8.1, August 31, 2026 | v0.21.0 “Pantheon,” August 31, 2026 |
| GitHub stars | 391,194 | 250,676 |
| Commercial plan from the developer | Not observed | Hermes Business and Hermes Enterprise (since September 2026) |
Release dates and star counts were pulled via the GitHub API on October 2, 2026 (OpenClaw releases, Hermes Agent releases). Stars reflect developer interest, not product maturity for enterprise use; in a corporate selection process, this is a secondary metric.
Both projects are updated very frequently. The OpenClaw 2026.9.7 release notes mention 2,818 pull requests and 334 contributors; Hermes v0.21.0 mentions about 2,475 merged pull requests and more than 760 contributors. For a company, that means two things: features appear quickly, but the system’s behavior also changes quickly. An update policy is needed from day one.
The Key Difference: Gateway vs. Agent
OpenClaw packages the agent around a messaging gateway, while Hermes Agent packages the gateway around a learning agent. Several independent comparisons use this wording, for example ScreenshotOne (“agent-first vs. gateway-first”). Almost everything else follows from that difference.
OpenClaw: the center is the Gateway. People connect to one gateway (through the browser, Slack, Microsoft Teams, Telegram, and other channels), along with agents, remote machines (nodes), and plugins. That is why OpenClaw naturally introduced shared sessions, coworker presence, roles, and handoff from one person to another. According to InfoQ, after the 2.0 release, the browser app became the primary interface rather than a secondary panel (InfoQ, September 2026).
Hermes: the center is the agent. Its strength is the learning loop: the agent saves successful methods as skills and loads them in similar tasks; it has memory, scheduled jobs (cron) that from version 0.21 “remember” previous runs, and subagents that can be managed on the fly (release notes for v0.21.0). Multi-user work is organized differently: multiple agent profiles on one machine, allowed users in messengers, and the Hermes Business commercial layer on top of Nous Portal.
Practical takeaway: if the main question is “how will ten employees work with agents together,” OpenClaw is the closer fit. If the main question is “how do we make one agent that gets better over time at a specific specialist’s repetitive work,” Hermes is the closer fit.
Web Chat and Shared Sessions in OpenClaw
This is a key change for enterprise work in 2026. Up to version 2.0, OpenClaw was seen primarily as a personal assistant in a messenger. Now it has a full team model. We covered the 2.0 release in detail in the article “OpenClaw 2.0: What Changed and How to Upgrade”; here, we’ll focus only on what matters for companies.
Web Chat in the Browser: Control UI
Control UI is a single-page web app served by the Gateway itself; by default, it opens at http://<host>:18789/ (Control UI documentation). In it, you can:
- chat with agents directly in the browser, without a messenger;
- run multiple sessions with different agents and group conversations;
- see synchronized "thinking," speed, and context window settings across all panels where the same session is open;
- see a list of colleagues Online: green indicator — active, yellow — inactive, hollow ring — connected but activity unavailable;
- connect to remote desktops through the built-in viewer, including picture-in-picture mode;
- attach a photo from the camera directly to a message.
For a company, this means employees do not need to set up an agent in their personal messenger: the work interface opens in the browser, and access to it goes through corporate identity verification (more on that below).
Shared Sessions: Open, Run, Take Over
The official team setup guide describes the target model like this: one Gateway for the entire team, a bot in the work chat you already use, shared sessions that anyone can open and run in Control UI, and roles that limit each person's actions (Team setup).
How it works in practice:
- An employee gives the agent a task in the work chat or in the browser. A session is created.
- A colleague opens the same session in Control UI, sees the full context, and can "steer" it: clarify the task, add materials, and correct the course.
- If the original author goes on vacation or the task moves to another department, the session can be taken over (take over) — along with the context, not just a summary.
InfoQ describes this as the ability for "multiple users to participate in an existing agent session while preserving context, handing the task off from one person to another" (InfoQ). In commenting on the release, the project creator said that "multi-user programming" with cloud sessions is what changed how the OpenClaw team itself works.
Who Did What: Attribution in Multi-User Mode
For enterprise accountability, collaboration is not enough; traceability matters too. In multi-user mode, each session has three attribution levels (Multi-user mode):
| Level | What it means | Can it be changed? |
|---|---|---|
| Creator | Who initiated the session, if this can be proven | No, it is fixed permanently |
| Owner | Who is currently responsible for the session; by default, the creator | Yes, can be reassigned |
| Participants | Authenticated people, senders from channels, and agents whose input is accepted into the session | Grows as work progresses |
In addition:
- live presence shows who is viewing the session and who is typing; starting with version 2026.9.5, a colleague's draft appears as "Typing · not sent," while unsent drafts do not get into either the model or the transcript (release 2026.9.5, Team setup);
- when a verified GitHub account is connected, the agent's commits get a
Co-authored-byline for the specific employee, and the pull request is linked to them — useful for development and code change auditing; - starting with version 2026.9.5, you can highlight part of a response and choose "Add to chat" to save a comment about it.
Roles and Access Policies
The team Gateway maps authenticated employee profiles to named operator roles; each role combines four policies: access to other people's sessions, available agents, the maximum set of operator rights (scopes), and whether a sandbox is mandatory for new sessions (Team setup, Operator scopes).
The access policy for other people's sessions sessions.others has four values:
| Value | What an employee can do in someone else's session |
|---|---|
none |
Cannot see other people's sessions either in the list or through a direct request |
view |
Can read but not modify |
suggest |
Can read and propose edits through the suggestion mechanism |
write |
Fully participates in the session |
Example from the documentation: a guest can work only in a sandbox without administrative access, and file and shell tools get a separate private workspace. For a company, this is a ready-made foundation for access separation: for example, interns — view and mandatory sandbox, analysts — suggest, process owners — write.
Session Share: shared access to conversations across installations
Version 2026.9.5 introduced a built-in plugin Session Share. It lets colleagues on another OpenClaw installation read selected groups of conversations in their Control UI (Session Share documentation, MarkTechPost, September 19, 2026).
Important limitations that security teams should know:
- the plugin is off by default;
- access is read-only: the recipient cannot continue the session, archive it, or open a terminal;
- only the text of user and assistant messages is shared; model reasoning, tool calls, their outputs, subagents, incognito sessions, and drafts are not shared;
- every time the transcript is read, it re-checks whether the session is still shared — revoking access takes effect immediately;
- the connection goes through a paired node (node) that is allowed only two read commands; the node does not allow shell execution, file browsing, uploading anything into the terminal, invoking plugins, MCP servers, or skills;
- editing masks credential patterns, but does not scrub arbitrary conversation content — if the conversation contained personal data or trade secrets, the recipient will see them.
Session Share is useful when different departments or legal entities in a group use different Gateways (and that is how it should be at different trust levels), but they need to show each other the results of agent work.
What else matters for teams in fall releases
- Four-agent team out of the box (2026.9.5): the setup wizard creates a "leader, researcher, author, reviewer" lineup (release 2026.9.5).
- Atomic updates (2026.9.5): the new version is validated before switching, and plugins can be installed without restarting Gateway. In 2026.9.7, improved backup handling during updates and rollback protection were added (2026.9.7 notes).
- Agent summary and Systems workspace (2026.9.5): recent activity and conversation previews on one page, plus a separate section for machines and remote desktops.
- OpenAI Agents API integration and ChatGPT sign-in (beta) in 2026.9.7 — for companies already using OpenAI enterprise subscriptions.
- Model independence: state stays on the user's infrastructure, cloud models, API providers, and locally installed models are supported (InfoQ). For Russian companies, this matters: you can build the stack on a local LLM inside the perimeter.
Hermes Agent team features
Hermes Agent also has a web interface and a command layer, but they are structured differently.
Web dashboard with chat — for one operator
The official Hermes web dashboard (hermes dashboard) includes Status, Chat, Config, API Keys, Sessions, Logs, Analytics, Cron, Profiles, Skills, MCP, Webhooks, Pairing, Channels, and System sections; the Chat tab embeds a full terminal UI (TUI) in the browser via WebSocket (Web Dashboard documentation).
Key enterprise takeaways:
- by default, the dashboard listens on
127.0.0.1:9119without authentication — this is only safe locally; - when bound to an external address, authentication is required: username and password (for trusted networks only), OAuth via Nous Portal, or your own OIDC provider (Keycloak, Auth0, and similar). If no provider is configured, Hermes refuses to start — this is the correct fail-closed behavior;
- the dashboard is a single-operator tool: one server manages all profiles on the machine, there is a profile switcher, but there is no collaboration between multiple people or role-based model inside one dashboard.
In other words, Hermes has a web chat with the agent, but in the documentation we reviewed there is no equivalent to OpenClaw shared sessions with colleague presence, task handoff, and roles view/suggest/write.
Profiles, messengers, and Bot Mode
- Profiles let you keep multiple isolated agents on one machine with their own settings, keys, skills, and MCP (Profiles). This is convenient, for example, for separate agents for “sales,” “support,” and “finance.”
- Messenger Gateway only lets in authorized users: if allowlists are not configured, by default everyone is blocked, and new users receive a one-time pairing code (Security).
- Bot Mode in version 0.21.0 is built into the desktop app: each agent profile has a name and avatar, you can create group chats where multiple bots and a user communicate in one room, and mention any bot with @ (release v0.21.0). This is multi-agent work, not multi-user work: the bots and you communicate in the room.
Hermes Business and Hermes Enterprise
In mid-September 2026, Nous Research launched enterprise plans (Nous Research post on X, TAO Media, September 15, 2026):
- Hermes Business in Nous Portal: invite colleagues to a shared account, a single balance with spending limits for each employee, shared skills that, in Nous’s wording, “become part of the company’s own intellectual property,” and agent work across different channels (CLI, Telegram, Discord, Slack, WhatsApp, Signal, email);
- Hermes Enterprise: the same capabilities on your own infrastructure or in a chosen cloud; according to TAO Media, this includes single sign-on (SSO), service-level agreements (SLAs), and implementation support.
Prices were not published in the sources reviewed. Nous’s statement that Enterprise is already used by “some of the world’s largest companies” is not backed by any names, so treat it as marketing. For Russian companies, you should separately verify whether payment and a contract with Nous Research are available; that is a legal question outside the scope of this article.
How this differs from OpenClaw. Hermes Business solves the problem of “one shared budget and shared skills for a team where each person has their own agent.” OpenClaw solves the problem of “shared sessions and collaborative human work on a single agent task.” These are different team-work models, and the choice between them depends on how your processes are structured.
OpenClaw Security
The main OpenClaw security rule is: one Gateway equals one trust zone. The documentation explicitly says the Gateway is designed for a single operator or a team whose members trust one another, and is not a security boundary for mutually untrusted users. For mixed-trust setups, the recommendation is to separate zones: a separate Gateway and separate credentials, ideally separate OS users or separate hosts (Security).
Built-in mechanisms
- Authentication with employee identity verification. The recommended option is Tailscale Serve: sign in by identity without shared secrets. An alternative is a trusted proxy with identity checks, such as Cloudflare Access. A shared token or password is also available, but then everyone works under the owner’s single profile and individual accountability is lost (Team setup).
- Default pairing. An unknown sender in direct messages gets a pairing code, not access; in groups, there are allowlists and activation by mention.
- Roles with mandatory sandboxing — see the section above.
- The
openclaw security auditcommand checks the configuration against secure defaults and suggests an order for fixing findings. - Wrapper for untrusted input and a recommendation to use strong, latest-generation models that are better at resisting prompt injection.
Vulnerability history
OpenClaw is the most popular open-source agent, and in 2026 it became a top target for researchers and attackers:
- according to a Cloud Security Alliance research note, 9 CVEs were disclosed in OpenClaw between March 18 and 21, 2026, including CVE-2026-22172 with a CVSS score of 9.9: a client could assign itself permissions when connecting over WebSocket and gain access to administrative functions ( 9 CVEs ),CSA, May 4, 2026);
- in early 2026, a supply-chain attack via the ClawHub skills directory known as ClawHavoc occurred: according to Aviatrix, more than 1,100 malicious skills disguised as useful tools were uploaded; some of them installed the Atomic macOS Stealer infostealer (Aviatrix). Different researchers cite different numbers, but the conclusion is the same: skills from the public directory should not be installed without verification. More on the risks of skills in the article “Security for AI Agent Skills”.
A note on the latest release
In version 2026.9.7, the default limit for simultaneous unauthenticated connections from a single IP was raised from 32 to 128. The documentation explicitly warns that this allows more sockets to consume server resources, and administrators can lower the limit again (2026.9.7 notes). In addition, browser access now uses the configured public address if no allowlist of addresses is set. This is a good example of why every update needs to be read with an administrator’s eye, not just a user’s.
Hermes Agent Security
Hermes Agent describes its protection as eight layers: user authorization, confirmation of dangerous commands, secure file writing, container isolation, credential filtering for MCP, scanning context files, session isolation, and input sanitization (Security).
Default strengths
- The Gateway blocks everyone by default. If allowlists are not set, access is closed and a warning appears at startup.
- Strict pairing: an 8-character code, 1-hour lifespan, no more than one request from a user every 10 minutes, a 1-hour lockout after 5 failed attempts, permissions
0600on pairing files. - Hard stop list: commands such as
rm -rf /, fork bombs, and formatting mounted drives are never executed — even in no-confirmation mode. - Protected Paths: writing to
~/.ssh/,~/.aws/,~/.kube/,/etc/sudoers,.envand Hermes token stores are always blocked. - Environment Filtering for MCP: MCP subprocesses receive only basic variables (
PATH,HOME,LANG, etc.); API keys are stripped unless explicitly allowed. - SSRF Protection: tools that work with URLs do not, by default, access internal networks (RFC 1918), loopback addresses, or cloud metadata endpoints; if DNS resolution fails, the request is blocked.
- Scanning Context Files (AGENTS.md, .cursorrules, SOUL.md) for signs of prompt injection and invisible Unicode characters.
- Docker containers run without unnecessary privileges: all capabilities are dropped except three,
no-new-privileges, and the process limit is capped at 256. - In version 0.21.0, the following were added: mandatory confirmation for writing to AGENTS.md, skills and memory (so that after injection, the agent cannot quietly rewrite its own instructions), expanded secret masking, and security checks during plugin installation; the Blender MCP server was removed from the directory after its upstream project was compromised (release v0.21.0).
Weaknesses to Be Aware Of
- The default approval mode is "smart": a helper LLM decides whether a command is risky — low-risk commands are approved automatically, dangerous ones are rejected, and ambiguous ones are handed off to a human. An independent audit in April 2026 (version 0.8.0) noted that LLM-based auto-approval is vulnerable to prompt injection (CSA). For enterprise environments, the manual mode or strict rules with
manualor strict rulesapprovals.denyis more appropriate. - YOLO mode (
--yolo,/yolo,HERMES_YOLO_MODE=1) disables all checks except the hard stop list. It should be prohibited by policy. - In the container backend, dangerous command checks are skipped: the container itself is treated as the security boundary. That makes sense, but it also means the agent can change anything mounted into the container without asking.
- The write sandbox
HERMES_WRITE_SAFE_ROOTis optional and is not set by default. - The tirith scanner runs in fail-open mode by default: if it is unavailable, commands are executed.
- The web dashboard without authentication on loopback is fine for a laptop, but dangerous on a shared server behind a misconfigured proxy.
Vulnerability History
Some English-language comparisons claim that Hermes has "zero CVEs" — for example, the Lushbinary review in the May 2026 table says "0 reported." As of October 2, 2026, that claim is not confirmed. CSA by May 2026 lists three disclosed medium-severity CVEs: CVE-2026-7396 (CVSS 4.0, path traversal in the WeChat Work adapter), CVE-2026-7397 (CVSS 4.8, symlink traversal in file tools), and CVE-2026-6829 (CVSS 5.3, path traversal in hermes-webui). It also mentions an independent audit from April 11, 2026, which found in the default configuration of version 0.8.0 4 critical and 9 high findings, including unconditional approval bypass in the container and persistence through skill installation (CSA, May 4, 2026).
Hermes' lower CVE count is partly explained by a smaller attack surface (no multi-user gateway with roles) and lower popularity, not just code quality. What matters is not CVE counts, but the threat model for your specific scenario. How AI agents are used in real attacks was covered in the article "AI Agent Attacked Thailand's Finance Ministry: Hermes, Not OpenClaw", and threat classes with real CVEs are discussed in "Why AI Agents Are Dangerous".
Security Approach Comparison
| Mechanism | OpenClaw | Hermes Agent |
|---|---|---|
| Trust model | One Gateway = one trust zone; untrusted users go on separate Gateways | One operator per machine; profiles are isolated |
| Human access | Tailscale Serve, identity-verified proxy, shared secret | Loopback without a password; from outside — password, Nous Portal OAuth, or your own OIDC |
| Access from messaging apps | Pairing in direct messages, lists and mentions in groups | Default deny, lists, pairing with limits and blocking |
| Human access control | Roles: sessions.others, agents, scopes, mandatory sandboxing |
No role model in the dashboard; separation through separate profiles and machines |
| Command confirmation | Execution and confirmation policies | Smart (LLM), manual, off; hard stop list always |
| Secret protection | Masking credential patterns | Protected paths, env filtering for MCP, masking |
| Configuration self-check | openclaw security audit |
hermes doctor, compromised package check |
| Exposed CVEs in 2026 (per CSA as of May) | 9 CVEs from March 18–21, max CVSS 9.9 | 3 CVEs, max CVSS 5.3; 4 critical audit findings |
| Main ecosystem risk | Malicious skills in ClawHub | Skills and plugins without review, LLM auto-approval |
Comparison table for companies
| Criterion | OpenClaw | Hermes Agent | Which is stronger for enterprise work |
|---|---|---|---|
| Web chat in the browser | Control UI is the primary interface | Chat tab in the web dashboard (TUI in the browser) | OpenClaw |
| Human collaboration in one session | Yes: open, manage, take over the session | Not observed in the documentation | OpenClaw |
| Colleague presence and drafts | Online list, “Typing · not sent” | No | OpenClaw |
| Roles and permissions for other people's sessions | none / view / suggest / write |
No role model in the dashboard | OpenClaw |
| Sharing conversations between installs | Session Share, read-only | Not observed | OpenClaw |
| Action attribution | Creator, owner, participants; Co-authored-by | Logs and sessions per profile | OpenClaw |
| Self-learning and skills | Skills and plugins, large catalog | The agent creates skills from successful solutions on its own | Hermes |
| Shared budget and limits per employee | Not observed by the developer | Hermes Business | Hermes |
| SSO and SLA from the developer | Not observed; SSO through an identity-verified proxy | Hermes Enterprise (by TAO Media) | Hermes, if you need a contract |
| Safe defaults for a single operator | Require configuration | Default deny, protected paths, SSRF filter | Hermes |
| Threat model for the team | Explicitly described: trust zones and roles | Designed for a single operator | OpenClaw |
| Channels | Browser, work chats, messaging apps, mobile nodes | CLI, desktop, web, messengers, email | Parity |
| Local models inside the perimeter | Yes, model-agnostic architecture | Model provider selection is configurable | Parity |
| Updates | Atomic, with verification and rollback | hermes update, frequent patches |
OpenClaw |
| Licensing and governance | MIT, independent foundation | MIT, commercial company | Depends on procurement policy |
What to choose: scenario-based solutions
In short: OpenClaw is for team collaboration, while Hermes Agent is for personal and role-based agents that learn from one specialist's work. Below is a breakdown by use case.
Scenario 1. A team works with an agent on shared tasks
Example: lawyers draft contracts, analysts compile reports, developers manage tasks, and work passes from one employee to another. Choose OpenClaw. Shared sessions, task handoff with context, presence, roles, and attribution solve exactly this problem. Hermes would need to be extended for this.
Scenario 2. A personal assistant for an executive or subject-matter expert
Example: a sales director wants an agent that gradually learns to prepare weekly summaries and emails. Choose Hermes Agent. The “successful decision → skill” loop and scheduled tasks with memory are an advantage, and a single operator is Hermes' natural model.
Scenario 3. Multiple departments with different trust levels
Example: accounting, sales, and engineering should not see each other's data. Choose OpenClaw with a separate Gateway for each trust zone and Session Share where results need to be shown to another department in read-only mode. The documentation explicitly does not recommend putting a single Gateway in front of the entire company with untrusted users.
Scenario 4. The company needs a contract, SLA, and developer support
Choose Hermes Enterpriseif you are comfortable with the “each user has their own agent + shared skills” model and it is legally possible to contract with Nous Research. We did not find a commercial enterprise plan from OpenClaw Foundation; in that case, your team or integrator handles implementation support.
Scenario 5. Sensitive data and a closed environment
Both projects can be deployed on your own infrastructure. The choice is driven not by the product but by the architecture: a local LLM inside the perimeter, no outbound connections except those allowed, separate hosts, and a vetted internal skill registry. For a team working collaboratively, choose OpenClaw; for an isolated personal agent, choose Hermes with a Docker backend and manual approval mode manual.
Scenario 6. Hybrid
A setup is possible where OpenClaw serves as the team foundation (channels, shared sessions, integrations), and Hermes acts as a personal learning agent for individual specialists. Keep in mind that there is no native integration between the frameworks: according to MindStudio MindStudio, you would have to build the connection yourself. Also, a hybrid doubles the attack surface and the volume of updates: start with one platform.
Verdict for October 2026
For internal corporate team work, choose OpenClaw. As of October 2, 2026, it is the only one of the two projects where human-agent collaboration—web chat, shared sessions, task handoff, roles, and conversation sharing—is described in the official documentation as the primary use case. The tradeoff is the need for serious security configuration and disciplined updates.
Choose Hermes Agent as a personal agent for individual specialists or as an enterprise product with a contract (Hermes Enterprise) if shared budgets, shared skills, and vendor support matter more than collaboration in a single session.
How to deploy OpenClaw in a company: checklist
- Define trust zones. One Gateway per team, where members trust each other. Separate departments with sensitive data need separate Gateways and separate credentials.
- Enable identity-based sign-in. Use Tailscale Serve or a proxy with identity verification (for example, Cloudflare Access or a corporate IdP behind the proxy). Do not use a shared team password: attribution is lost.
- Set up roles before launch. Define
sessions.others, available agents, scopes, and a mandatory sandbox for each role. Start with the minimum privileges and expand on request. - Lock down the skill catalog. Allow only skills and plugins that have passed internal review; public skills from ClawHub should be used only after code review.
- Run
openclaw security auditand fix findings in the order of priority returned by the team. - Check your network settings after 2026.9.7. Set an allowlist of browser addresses and, if needed, lower the unauthenticated connection limit below 128.
- Enable Session Share intentionally. Use it only for the necessary conversation groups and remember that message content is not cleared.
- Choose a model. For an internal environment, use a local LLM or a provider with suitable data handling terms; the documentation recommends strong next-generation models as more resistant to prompt injection.
- Set an update policy. Use atomic updates, create a backup before switching, test the new version in a staging Gateway, and have the administrator read the release notes.
- Assign owners for sessions and processes. Attribution is useless if no one is responsible for the outcome. For agent autonomy levels, see the article “Managing AI Agent Autonomy”.
How to deploy Hermes Agent in a company: checklist
- Set explicit allowlists of users for each channel; never enable
GATEWAY_ALLOW_ALL_USERS=true. - Use a Docker backend (
terminal.backend: docker) with CPU, memory, and disk limits, and keep in mind that dangerous command checks are not performed inside the container. - Set approvals to
manualor configureapprovals.denyfor critical operations; block YOLO with policy and configuration checks. - Set
HERMES_WRITE_SAFE_ROOTto restrict writes to working directories, keeping in mind that this may interfere with Hermes’ own state writes. - Do not expose the web dashboard to the public internet without OIDC. For teams, use your own identity provider and TLS on the proxy.
- Run the gateway as a non-root user and store keys in
~/.hermes/.envwith600permissions. - Restrict skill and plugin installs to an internal trusted registry and review manifests, especially install commands.
- Consider fail-closed mode for tirith (
tirith_fail_open: false) if scanner downtime should not allow commands through. - Update regularly (
hermes update) and watch for warnings withhermes doctor. - If you need team collaboration, decide on the operating model: a separate profile or machine per employee, shared skills through Hermes Business, or your own internal skills repository.
Common mistakes when choosing
- Choosing based on GitHub stars. Popularity says something about the ecosystem, but nothing about fit for your threat model.
- Trusting outdated comparisons. Many English-language reviews were written before OpenClaw 2.0 and Hermes Business; they do not account for shared sessions, roles, and enterprise plans, and some of them incorrectly claim that Hermes has zero CVEs.
- Putting one Gateway in front of the whole company. For OpenClaw, that conflicts with the official trust model.
- Exposing the web interface to the internet “temporarily.” Both Control UI and the Hermes dashboard require identity-based login and TLS.
- Installing public skills without review. The ClawHavoc attack showed that the skills catalog can be a delivery channel for malicious code.
- Confusing multi-agent with multi-user. Hermes Bot Mode is many bots and one person; OpenClaw shared sessions are many people and a shared agent context.
Frequently asked questions
What is better for a company: Hermes or OpenClaw?
For team collaboration in October 2026, OpenClaw is better: it has web chat, shared sessions with handoff, roles, and conversation sharing. Hermes Agent is better as a personal learning agent or as an enterprise product under contract through Hermes Enterprise.
Can you use OpenClaw through web chat without a messenger?
Yes. Control UI is a browser-based app served by the Gateway itself (port 18789 by default). In it, you can chat with agents, manage multiple sessions, see coworkers online, and control remote desktops.
How do shared sessions work in OpenClaw?
A session created by one employee can be opened by other team members in Control UI, continued, or taken over along with its context. Permissions are determined by role: none, view, suggest or write. Each session records the creator, owner, and participants.
Does Hermes Agent have a web interface?
Yes, there is an official web dashboard with Chat, sessions, logs, analytics, and settings. But it is a single-operator tool: it does not support collaboration between multiple people or a role model. It can only be exposed externally with a password, OAuth Nous Portal, or your own OIDC.
Is it true that Hermes Agent has no vulnerabilities?
No. According to the Cloud Security Alliance as of May 2026, three medium-severity CVEs have been disclosed, and an independent audit of version 0.8.0 found 4 critical and 9 high-severity issues in the default configuration. Since then, Hermes has significantly strengthened security, but regular updates are mandatory.
Is it safe to use OpenClaw in a company after all the CVEs?
Yes, if you follow the trust model: a separate Gateway for each trust zone, identity-based login, sandboxed roles, a closed skills catalog, openclaw security audit and an update policy. Without these measures, no.
Can both products be used at the same time?
Yes: OpenClaw as the team foundation, Hermes as the personal agent for individual specialists. But that doubles support and the attack surface, so it is better to start with one platform.
Primary sources and verification method
All facts were verified on October 2, 2026. We did not conduct our own product testing: the comparison is based on developer documentation, release notes, and independent reports.
- OpenClaw documentation: Team setup, Control UI, Multi-user mode, Operator scopes, Session Share, Security — team model, roles, security.
- OpenClaw 2026.9.5 Release Notes and GitHub Release 2026.9.7 — new features and network default changes.
- InfoQ on the OpenClaw 2.0 Release — browser app and shared cloud sessions.
- Hermes Agent Documentation: Security, Web Dashboard, Profiles — security model and web dashboard.
- Hermes Agent v0.21.0 Release Notes — Bot Mode and stronger security.
- Nous Research publication and TAO Media — Hermes Business and Enterprise.
- Cloud Security Alliance research note — CVEs in both projects and Hermes audit.
- Aviatrix on ClawHavoc — attack through the skills directory.
- GitHub API, October 2, 2026 — release dates, star counts, licenses.
“Who’s better” comparisons in tables and scenario-based recommendations — AIrassvet editorial analysis based on the sources listed above. Both projects’ features change weekly: check the latest release notes before making a decision.
How AIrassvet helps you choose and deploy an enterprise agent
Choosing between OpenClaw and Hermes Agent is not about picking the “best agent,” but about choosing the trust model, collaboration model, and support setup that fit your workflows. AIrassvet implements intelligent AI agents integrated with communication channels and business systems, enterprise AI environments, and LLM deployment, including on-premise. For this use case, we can:
- audit the workflow and determine which model — shared team sessions or personal agents — fits it, and how many trust zones are needed;
- deploy the agent platform in your environment with a local LLM if data must stay within your perimeter;
- integrate agents with the company’s work chats and business systems, and test scenarios before launch;
- train the team to work with agents and support the system after launch.
A realistic first step is to choose one workflow, document its current state, data sources, security constraints, and acceptance criteria. From there, it becomes clear whether you need OpenClaw’s team model or Hermes’ personal model.
Bottom line: OpenClaw for teams, Hermes for a personal agent
In October 2026, OpenClaw and Hermes Agent stopped being just “personal assistants for enthusiasts” and gained enterprise features, but in different ways. OpenClaw became a collaboration platform: a Control UI web chat, shared sessions that can be led and handed off, roles with access policies, attribution, and Session Share. Hermes Agent remained the strongest option for a self-learning personal agent with strict defaults and added Business and Enterprise commercial tiers.
For internal team work, choose OpenClaw and build in trust zones, identity-based sign-in, roles, a private skills directory, and an update policy from the start. Add Hermes where you need a personal agent for a specific specialist or a vendor contract. In both cases, start with one workflow, not the whole company.