Hermes Agent Review 2026: Features, Memory, Skills and Security

In March, Hermes Agent looked like one more ambitious open source project trying to catch the biggest name in personal AI agents. At the time, one popular Medium comparison described Hermes with roughly 6,000 GitHub stars while OpenClaw had around 307,000. The gap was so large that calling Hermes a competitor sounded less like a market observation and more like a prediction.

Six months later, that prediction looks much less ridiculous. Nous Research’s Hermes Agent now sits around 243,000 GitHub stars. OpenClaw is still larger at roughly 389,000, but the comparison has changed completely. Hermes is no longer a tiny project being discussed because it might become interesting. It has become one of the largest open source personal agent projects in the category.

More importantly, the project itself has changed. The early appeal of Hermes was easy to summarize. It was Python based, model agnostic, capable of persistent memory, able to create reusable skills, and flexible enough to run on a VPS while talking to the user through Telegram or other messaging platforms.

Access without medium partner: Hermes Agent Vs OpenClaude Claw

The current Hermes is much broader. It has a desktop application, a richer terminal interface, multiple messaging gateways, scheduled automation, MCP support, browser tools, voice, subagents, Bot Mode, persistent memory, session search, a Skills Hub, multiple execution backends, A2A support, and a security model built around approvals and isolation.

That feature list makes Hermes look more like OpenClaw than it did in March. The more important difference is philosophical. OpenClaw is becoming an increasingly polished control system for an agent that can operate across devices, applications, tools, and messaging channels. Hermes is trying to become an agent that gets better at being your agent the longer it runs.

That is the competition worth paying attention to.

The real Hermes feature is not Telegram, cron, or another model provider

Most personal agent frameworks now have a familiar checklist. They can call tools, run shell commands, read files, connect to messaging apps, schedule tasks, use MCP servers, switch between model providers, and maintain some form of memory.

Once enough projects offer the same checklist, another Telegram integration is no longer a reason to switch agents.

Hermes is trying to differentiate itself with a closed learning loop. Nous Research describes Hermes as “the agent that grows with you.” That is marketing language, but underneath it is a concrete design idea. Hermes can maintain persistent information about the user, search previous sessions, create procedural skills from successful work, and later improve those skills as they are reused.

That last part matters. Normal agent memory answers a question such as: “What should this system remember about the user?” Procedural memory answers a different question: “What did this system learn about how to do this task?”

That distinction may be the most important reason Hermes has become interesting.

Most AI memory systems remember facts. Hermes wants to remember methods.

Hermes separates persistent memory from skills. Its built in memory system keeps bounded notes in files such as MEMORY.md and USER.md. The documentation deliberately limits their size so the agent does not turn every conversation into an ever expanding prompt. Those files can retain useful information about preferences, environment details, ongoing projects, conventions, and expectations across sessions.

Hermes also keeps session history in a searchable database. Its session search tools can retrieve actual messages from older conversations instead of relying only on whatever small summary happened to survive into long term memory.

Then there are skills. A skill is reusable procedural knowledge. It can describe how to complete a recurring workflow, invoke existing tools, wrap a command line utility, include templates or scripts, and evolve as Hermes learns better ways to perform the task.

That creates a different relationship with the agent. The first time an agent solves a complicated deployment problem, it may have to reason through every step. The tenth time, the ideal system should not behave as if the previous nine attempts never happened.

Hermes is explicitly trying to close that loop.

This sounds obvious. Most agents still do not do it well.

Large language models are extremely good at appearing experienced while repeatedly paying the cost of rediscovering the same procedure.

A developer can spend forty minutes teaching an agent the unusual deployment process for one repository. A week later, a fresh session may need the same explanation again. A long context window can postpone that problem, but it does not solve it.

Keeping every historical conversation in the prompt is expensive, noisy, and eventually impossible. Summaries help, but summaries are usually optimized around remembering facts rather than preserving a reliable executable workflow.

Skills are an attempt to compress experience into something operational. Instead of remembering an entire conversation about how a particular server is deployed, the agent can retain the actual procedure that worked.

That can be much more useful than simply remembering that the server exists. This is where Hermes starts to feel less like another chatbot shell and more like a system trying to accumulate operational knowledge.

The dangerous part is that an agent can also learn the wrong lesson

Self improvement sounds wonderful until the thing being preserved is a mistake.

An agent can succeed for the wrong reason. A workaround can be temporary. A command that was safe in one project can be destructive in another. An API can change. A skill can slowly collect assumptions that no longer apply.

The same feature that makes Hermes attractive therefore creates a new maintenance problem. Procedural memory needs review.

A skill should not become trusted merely because an LLM wrote it after one successful task. Hermes exposes its skills as files rather than hiding them inside an opaque proprietary memory system, which is a major advantage. The user can inspect what the agent created, edit it, version it, share it, or delete it.

That transparency is important. The agent that learns should also make it easy to inspect what it learned.

Hermes grew far beyond the March version

The original March tutorial described a relatively young command line agent that could be installed on Linux, macOS, or WSL, connected to providers such as OpenRouter and OpenAI, and configured through files under ~/.hermes.

That description is still recognizable. It is no longer complete.

Hermes now ships with a much larger operational surface. The project supports Telegram, Discord, Slack, WhatsApp, Signal, and CLI access through a gateway. It supports scheduled jobs, multiple terminal backends, subagent delegation, MCP integration, web tools, browser automation, image generation, text to speech, and persistent cross session workflows.

Its desktop application has also turned Hermes into something less intimidating for users who do not want to live entirely inside a terminal.

The August 2026 v0.20 release was particularly revealing. Nous Research added realtime conversational voice with streaming speech, on device wake words, A2A v1.0 communication, signed outbound webhooks, grounded research with citations, plugin support for the desktop app, improved compression, and better tool recovery.

The latest tagged release, v0.21.1 from September 7, continues the rapid pace with work across desktop sessions, MCP authorization, cron delivery, delegation reliability, startup performance, and provider support.

This is no longer the project described by a 6,000 star comparison in March.

OpenClaw did not stand still either

The mistake would be to look at Hermes’s growth and assume OpenClaw has been waiting to be caught.

OpenClaw has also matured aggressively. OpenClaw 2.0 arrived at the end of August with a major focus on simplifying setup and making the browser based experience feel like a first class product rather than developer infrastructure. Its rebuilt Control UI places conversations at the center while keeping files, approvals, settings, and live agent activity close to the same workspace.

The project also has a much larger channel surface. OpenClaw describes itself as supporting 29 channels, with state stored locally and a Gateway connecting models, tools, messaging systems, and companion applications.

Its multi agent system is mature enough to give separate agents their own workspaces, authentication, sessions, identities, and routing rules. OpenClaw also continues to invest heavily in security tooling.

The current release includes openclaw security audit guidance for identifying dangerous cross agent session access and narrowing permissions. That kind of operational visibility is exactly what becomes necessary once a personal agent turns into infrastructure.

OpenClaw’s advantage is no longer simply that it arrived first. It increasingly feels like the more mature operating environment.

Hermes finally has a serious security story too

One of the weaknesses in early Hermes comparisons was that OpenClaw offered more obvious auditing and administrative controls.

Hermes has closed part of that gap.

Its current documentation describes eight layers in the security model: user authorization, dangerous command approval, file write protection, container isolation, MCP credential filtering, context file scanning for prompt injection, cross session isolation, and input sanitization.

Dangerous shell commands can go through a smart approval system. Low risk operations can be approved automatically, obviously dangerous operations can be denied, and uncertain commands can be escalated to the user.

The default behavior for unattended cron jobs is especially important. If a scheduled job reaches a command that would normally require human approval, Hermes can fail closed instead of simply executing it because nobody is watching.

Hermes also supports isolated execution backends including Docker, Modal, Daytona, Singularity, and Vercel Sandbox. That is the correct direction for an autonomous agent.

An agent with shell access should be treated as software capable of making mistakes at machine speed.

The documentation also contains the warning more projects should print in large letters

Hermes’s own security documentation makes an important distinction. Command deny rules and write protections are guardrails. They are not a complete sandbox against a malicious or compromised process.

That may sound like an implementation detail. It is actually one of the most important truths about personal agents.

If an agent runs terminal commands as the same operating system user who owns all the files, no clever pattern matcher can guarantee safety. A shell is too expressive. Commands can be wrapped, renamed, scripted, or reached through another interpreter.

Real containment requires operating system boundaries. That means containers, separate virtual machines, restricted credentials, constrained mounts, network policies, or other genuine isolation.

Users who install powerful agents on a personal workstation and immediately give them unrestricted access to SSH keys, cloud tokens, browser sessions, source repositories, and home directories are creating a risk no agent framework can completely erase.

Hermes is getting better at acknowledging that reality. OpenClaw has spent more time living with it.

Hermes’s model independence is more important than it first appears

Hermes does not require a Hermes language model. The agent can work with Nous Portal, OpenRouter, OpenAI, and other compatible endpoints. Users with sufficient hardware can also run models locally.

This keeps the framework separate from the intelligence provider.

That separation is strategically useful. Agent frameworks are becoming more persistent than individual model preferences. A developer might prefer an OpenAI model for one task, Claude for coding, a Qwen model locally for private documents, and a cheaper model for scheduled background work.

Rebuilding the entire personal agent every time the model leader changes would be absurd.

Hermes treats the model as replaceable. OpenClaw does too. That is one area where the open agent ecosystem is converging on the right idea.

The durable asset should be the user’s tools, memory, workflows, permissions, sessions, and skills. The model can change underneath them.

Hermes is stronger when the work repeats

The learning loop makes Hermes most compelling for recurring operational work.

Consider a developer who repeatedly triages issues, runs the same repository checks, prepares the same release notes, and deploys to the same environment. An ordinary agent can perform those tasks. Hermes is designed to notice that the procedure itself deserves to become reusable knowledge.

The same applies to research workflows. An analyst may repeatedly search the same sources, normalize data into the same structure, apply the same filters, and produce the same type of report. The value is not only automating today’s report. It is making tomorrow’s version require less rediscovery.

Scheduled jobs make this more interesting. Hermes cron tasks can run in fresh agent sessions, load one or more skills, work inside a specified project directory, and deliver results back through configured platforms.

A skill can therefore become more than a prompt template. It can become part of an unattended operating process.

That is a meaningful step toward personal infrastructure.

OpenClaw is stronger when control and visibility matter more than learning

OpenClaw’s current advantage becomes clearer when the system is judged as something that has to be operated rather than admired.

Its Control UI is more polished. Its channel support is broader. Its multi agent routing is mature. Its security audit surface is more explicit. Its enormous community has spent more time finding edge cases.

For users who want a personal agent that behaves like a product, those things matter.

The agent that learns the most is not automatically the agent someone wants managing important workflows. Sometimes predictability is the feature.

A company may prefer a workflow that changes only when a human edits it. A security conscious user may prefer explicit configuration over automatically evolving procedures. A team may care more about permissions, routing, auditability, and clear operational boundaries than about an agent teaching itself a better way to perform a recurring task.

This is where the Hermes versus OpenClaw comparison becomes useful. They are increasingly competing over different definitions of what “better” means.

Hermes’s Python foundation is attractive, but language choice is not a security feature

The original Medium article liked Hermes partly because it is Python based and therefore easy for many developers to read.

That remains a real advantage. Python lowers the barrier for a huge part of the AI community. Developers can inspect the implementation, patch behavior, create tools, and understand how the agent interacts with the file system without learning an unfamiliar ecosystem.

But readable code should not be confused with safe code.

Open source is inspectable, not automatically inspected. A repository with hundreds of thousands of stars and tens of thousands of changes can contain more code than any normal user will review before installation.

The same is true of OpenClaw.

The practical security question is not whether the project is written in Python or TypeScript. It is what permissions the running process receives, what credentials it can access, what isolation exists, what commands require approval, and whether the operator can understand what happened after something goes wrong.

That is a less exciting argument than “Python feels trustworthy.” It is also the one that matters.

The 243,000 star number should not be mistaken for a benchmark

GitHub stars are evidence of attention. They are not proof that Hermes is better than OpenClaw.

The comparison is especially dangerous because open source AI projects have become unusually viral. A project can gain tens of thousands of stars because the idea is exciting, the demo is impressive, or the social media story is easy to repeat.

Hermes’s growth is still significant.

Moving from roughly 6,000 stars in March to around 243,000 in September means the project escaped the niche status of its early coverage. It now has enough users, contributors, issues, integrations, and external attention to influence how other agent frameworks are built.

OpenClaw remains larger at around 389,000 stars and more than 80,000 forks. The gap has narrowed dramatically.

The product question remains open.

The most important competition may be memory versus control

OpenClaw and Hermes increasingly represent two attractive instincts in personal agent design.

The first says the agent should be controllable. Give it clear workspaces, permissions, channels, a gateway, security policies, and a good interface for seeing what it is doing.

The second says the agent should become more capable through experience. Let it preserve useful facts, search old sessions, convert successful work into procedural skills, improve those skills, and build a better model of the user over time.

A serious personal agent eventually needs both.

Too much control without learning produces a sophisticated automation system that keeps forgetting how the user works. Too much learning without control produces an unpredictable piece of software that quietly changes its own procedures.

The winning architecture is probably somewhere in the middle.

Who should choose Hermes now?

Hermes makes the most sense for users who actively want an agent they can shape.

Developers who are comfortable inspecting files and skills will appreciate that much of the system is legible. Researchers can benefit from model flexibility, session recall, automation, and delegation. Homelab users can run it on a spare machine, VPS, container, or cloud sandbox and interact with it remotely.

It is especially compelling when work is repetitive enough that procedural learning has value. If the same complicated task is performed every week, Hermes’s skill system can be more important than a prettier chat interface.

Hermes is also attractive to people who dislike tying an agent to one model vendor. The framework can survive a change in model preference.

That matters more every month.

Who should choose OpenClaw?

OpenClaw remains the safer default recommendation for users who value maturity, broader integrations, a polished control surface, and a large established ecosystem.

It is particularly attractive when one gateway has to coordinate several agents, channels, workspaces, and identities.

The project has had more time to encounter painful operational problems. That history matters.

An agent framework is not judged only when everything works. It is judged when a tool returns malformed data, a provider changes behavior, a session crashes, a user sends a message from the wrong channel, a background task needs approval, or an agent gets access to something it should not have seen.

Maturity is partly the accumulation of scars.

OpenClaw has more of them.

The better agent may depend on what the user wants to accumulate

This is the question that makes the comparison clearer.

Should the system accumulate configuration or experience?

OpenClaw excels at building a durable operational environment around the agent. Hermes is unusually focused on accumulating reusable knowledge inside the agent.

Neither approach makes the other obsolete. In fact, the market may end up forcing both projects toward the same destination.

OpenClaw will need richer learning. Hermes will need increasingly polished governance and control.

The interesting part is which side reaches the middle without destroying what made it distinctive.

Six months changed the argument completely

The March version of Hermes was interesting because it looked surprisingly capable for a project with only a few thousand stars.

The September version is interesting for the opposite reason. It grew fast, and the software grew with it.

The project moved from a command line curiosity into a broad agent platform with a desktop application, voice, gateways, skills, persistent memory, subagents, scheduled automation, MCP, A2A communication, security controls, and a giant open source community.

OpenClaw is still ahead in raw popularity and remains the more mature product in several important areas.

But the old framing no longer works.

Hermes is not the tiny alternative to OpenClaw. It is now one of the projects defining what the next generation of personal agents should be.

Its most important idea is not a dashboard, a Telegram bot, or another integration. It is the belief that an agent should not merely remember the user. It should remember how it became useful.

That is a much harder feature to build well.

It may also be the feature that makes an AI agent worth keeping for years instead of replacing every time a better chatbot arrives.

OpenClaw built the category around an agent that can do things. Hermes is betting the next step is an agent that learns how you do them.

Six months ago, that sounded like an interesting experiment.

At roughly 243,000 GitHub stars, it has become a serious argument.