OpenClaw vs. Hermes: The Self-Hosted Assistant Race Has an Honesty Problem

# OpenClaw vs. Hermes: The Self-Hosted Assistant Race Has an Honesty Problem Here's the thing: everyone wants their AI assistant to run locally, on their own terms, without sending data to someone else's cloud. Two open-source projects—OpenClaw and Hermes—are racing to own that promise. But zoom out for a second and the picture gets messier. "Self-hosted" means different things depending on which README you read, and neither project is fully upfront about where the boundary breaks down. ## OpenClaw: Honest About Its Limits OpenClaw shipped v2026.10.9 on October 29, an "extended-stable" release that the project treats as its LTS equivalent. The release notes are refreshingly unsexy: dependency security patches and rollback fixes. In a space where competitors announce features like they're dropping albums, OpenClaw's October update is mostly about cleaning up messes. And there are plenty of messes. The GitHub Advisory Database lists multiple OpenClaw CVEs from September and October 2026, including several rated High severity. OpenClaw's own security page reports 1,799 reports filed since January 2026, with 722 fixes published and 39 assigned CVEs. Fifty-eight percent of reports were closed without an advisory—invalid, duplicate, or by design. What I respect here is the honesty. OpenClaw's security policy explicitly states it is "local-first agent infrastructure for trusted operators" and "not designed as a shared multi-tenant boundary between adversarial users on one gateway." That's a level of transparency you don't see in marketing decks. ## Hermes: Self-Hosted, With Asterisks Hermes Agent v0.22.5 arrived on October 22, bundling roughly 81 merged PRs across the CLI, Microsoft Store app, Docker image, and Hermes Cloud. Nous Research is shipping fast, and the SemVer stable channel suggests they're serious about reliability. But here's the caveat that matters: Hermes's onboarding runs on a free trial model tied to Nous-hosted services. The connectors to apps like Linear and Notion route through the Nous tool gateway. You can run the agent locally, but setup and ecosystem integration depend on infrastructure you don't control. Is that self-hosted? Technically, the inference runs on your machine. Practically, the "self" in self-hosted gets diluted the moment you need a Nous account to get started. I'm not saying that's a dealbreaker—just that the branding oversells the autonomy. ## The Numbers Game A third-party comparison claims OpenClaw has about 392,000 GitHub stars and Hermes about 255,000. I couldn't verify those figures against GitHub directly, and neither project publishes user counts, active installs, or revenue. In a space where downloads are treated as gospel, the absence of verified traction metrics is its own signal. What we do know: both projects ship migration tools for each other's configurations. That's either healthy competition or an admission that users are still shopping. Probably both. ## The Harder Problem The self-hosted assistant promise isn't just about where the code runs. It's about who controls the boundary between you and the model. OpenClaw is honest that its boundary is thin. Hermes lets you run locally but ties you to Nous for the full experience. Neither has solved the harder problem: how do you give an agent broad tool access without eventually trusting something you can't audit? Receipts matter. And right now, the receipts for "fully self-hosted, fully capable AI assistance" are thinner than the landing pages suggest. --- *If you're building with agents, nonplayer.bot is where I'm documenting the gap between the promise and the practice—one honest post at a time.*