# Inside the personal AI runtime wars: 487K stars, 57K issues, 25 SaaS businesses

URL: https://www.thedeepfeed.ai/posts/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/
Category: Agents
Published: 2026-04-26
Author: the-deep-feed
Tags: openclaw, hermes-agent, personal-ai, open-source, agent-architecture, security
Kind: deep

> OpenClaw has 138 CVEs, a 1GB/min memory leak, and a supply-chain attack where 80% of audited skills were malicious. Hermes's flagship feature silently deleted user data on launch day. The SaaS ecosystem built on their pain has 25+ providers.

## TL;DR

- **OpenClaw** has 138+ CVEs in 4 months, a gateway memory leak growing at **1GB/min**, a supply-chain attack where **80% of audited skills were malicious**, and the founding developer acqui-hired to OpenAI mid-crisis. Spending caps were requested in March, closed as **"not_planned."**
- **Hermes Agent** (122K stars, 73 days old) ships at 2,600 files changed per week. Its flagship Curator feature silently deleted user custom skills the day it launched. The core agent memory — Hermes's primary product promise — is **non-deterministic** in Gateway mode per Issue #16155.
- The **real root causes** behind 57,000 combined GitHub issues: OpenClaw's gateway is an unguarded monolith with no circuit breakers; Hermes has a 15,411-line core file where silent failure is a consistent design pattern across every layer.
- **25+ SaaS businesses** now exist entirely to solve the setup-pain these tools create. One audited managed provider found 373 actively malicious skills in ClawHub and built a competing skill marketplace. None of the providers have solved cost control, multi-agent coordination, or compliance.
- The emotional arc of 2026 on X: OpenClaw euphoria → OpenClaw crisis (Anthropic cutoff, steipete exits, 8 critical CVEs) → Hermes as the relief valve. Chinese developers call Hermes **"爱马仕"** (Hermès the luxury brand). OpenClaw's community rage-files issues with all-caps titles. Both narratives are real.

487,664 combined GitHub stars. 57,000 combined open GitHub issues. 25 SaaS businesses built to solve their setup pain. One supply-chain attack where 80% of tested skills were malicious. A founder who joined OpenAI mid-crisis. A flagship feature that silently deleted user data on launch day.

This is not the story most coverage tells about **OpenClaw** and **Hermes Agent**.

The star counts are real. The token volume is real (OpenClaw is [#1 on OpenRouter](https://openrouter.ai/rankings) by total usage, 19.9 trillion tokens). The growth trajectory is real (Hermes hit 100,000 stars in 46 days, the fastest in this category). What is less covered is what the GitHub Issues, X threads, and HN comments reveal when you read them in volume — the actual failure modes, the community emotional arc, the structural problems that will determine whether either project compounds its lead or yields to something more stable.

This is the deeper cut.

![OpenClaw: fractured gateway, 22 pipes, dollar sign on fire. Hermes: spiral brain with red warning node at the memory spine.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/architecture-split.jpg)

## Reading 48,000 OpenClaw issues from the inside

![138 CVEs in 4 months — a schematic grid of OpenClaw's bug-density. Top tiles are lower-severity issues; the bottom row holds CVSS 9.9 critical vulnerabilities including the Node invoke approval bypass and privilege escalation.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/bug-density-grid.jpg)

The version string format is `2026.M.D`. That means when you read a GitHub issue title ("[Regression] v2026.3.28 inverts model fallback logic"), you can pinpoint the exact release that broke things. OpenClaw ships daily or near-daily patches, and the community has learned to treat each version as a named entity with its own personality.

[Issue #57063](https://github.com/openclaw/openclaw/issues/57063): "v2026.3.28 inverts model fallback logic and leaks session modelOverrides, causing massive latency." Same release (v2026.3.28) triggered the financial crisis: [Issue #60450](https://github.com/openclaw/openclaw/issues/60450), filed April 3, still open, still unresolved: "Runaway API calls burned entire monthly budget across all providers without user action." The inverted fallback logic caused agents to retry across all configured providers simultaneously instead of failing over cleanly. Users who had three or four providers configured had three or four simultaneous retry storms running in parallel.

The gateway process (a single long-running Node.js process that owns sessions, plugins, channels, and model routing simultaneously) is the blast radius. When it breaks, everything breaks. [Issue #72434](https://github.com/openclaw/openclaw/issues/72434): "Regression in v2026.4.24: agent harness 'claude-cli' is not registered, all gateway requests fail." Every gateway request. Not some. Every one, for roughly 24 hours until a hotfix shipped.

But the regression problem is downstream of a worse structural problem: the gateway leaks memory at a rate that makes unattended server deployments impossible.

### The memory leak is a production blocker

[Issue #45438](https://github.com/openclaw/openclaw/issues/45438) has been open since March 13. The root cause is identified — `structuredClone()` called in a hot path of the session cache creates a V8 native memory leak at approximately 1GB per minute under load. The issue is tagged, commented, and has been sitting unresolved for seven weeks.

[Issue #54155](https://github.com/openclaw/openclaw/issues/54155): "Gateway memory leak: 389MB → 14.7GB over 4 days." That is a working trajectory. Day 1: the gateway starts. Day 4: it is a 14.7GB process on a VPS where you purchased 8GB of RAM. [Issue #62717](https://github.com/openclaw/openclaw/issues/62717): "RSS grows to 3-4GB within 1-2 hours, then the process silently exits with no log output." Silent exit. No crash log. No restart. The gateway is simply gone.

The community workaround, circulating on GitHub and Discord:

```bash
0 */4 * * * openclaw gateway restart --soft
```

Restart every four hours to shed accumulated memory. This is not documentation. This is folklore that has become operational fact for anyone running OpenClaw on a server.

The root cause is architectural: the SessionManager, fileEntries Maps, and cron Maps all accumulate without eviction logic. This is not one bug — it is a pattern across the gateway codebase where Maps are added and never cleaned up.

### The cost problem has no native solution

[Issue #38248](https://github.com/openclaw/openclaw/issues/38248), filed March 6: "Per-hour spending ceiling to prevent runaway failover costs." Closed as **"not_planned."** This single close decision was screenshot and distributed widely on X. It was the canonical example, more cited than any specific bug, of the maintainers not treating user financial damage as their problem.

The agent loop design has no circuit breaker. No spending cap. No anomaly detection for runaway calls. [Issue #57432](https://github.com/openclaw/openclaw/issues/57432) measured the failure mode precisely: an agent entered an infinite `/approve` exec loop and burned **965 API calls in 58 minutes**. [Issue #62614](https://github.com/openclaw/openclaw/issues/62614) identified another: after a rate limit response, the retry logic resends the full oversized context, gets rate-limited again, and resends again — a retry storm where each iteration is the maximum possible token payload.

The Medium article that went viral in February 2026 ran the math on a plausible failure case: an agent picks up a support ticket, decides its response isn't good enough, loops at $0.08 per iteration. At 200 iterations, 90 seconds, that is $16 from one bad triage. The article's title, "Someone Spent $3,600 in One Month on a 'Free' AI Assistant," is the sentence that defined OpenClaw's mainstream reputation.

There is one documented workaround: route the heartbeat ping (every 30 minutes, 48 API calls per day while idle) to a local Ollama model running something small like llama3.2:1b. It is not in the default config. It is not in the documentation. It is in a comment thread on a GitHub issue.

### 138 CVEs: what broke and why

**CVE-2026-25253**, named "ClawBleed" by the security community, published February 1. CVSS 8.8 (High). The attack flow: an attacker crafts a URL with `?gatewayUrl=attacker-server`. A user clicks the link. The OpenClaw Control UI automatically connects a WebSocket to the attacker's server and sends the authentication token. The attacker uses that token to issue commands on the victim's OpenClaw gateway, which has shell access to the host machine.

This is a one-click RCE. No user action beyond clicking a link. Proof-of-concept was published on Sploitus on April 18. [Shodan data at disclosure time](https://nvd.nist.gov/vuln/detail/CVE-2026-25253) found 42,000+ instances exposed on the public internet. 63% of publicly accessible instances were reported unpatched.

**CVE-2026-28466** (CVSS 9.9): "OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands." Any authenticated gateway client could inject approval control fields and execute arbitrary commands on all connected nodes. Every connected node. Not just the gateway machine.

**CVE-2026-32922** (CVSS 9.9): Privilege escalation within the dispatcher. The April 2026 patch batch alone added 13+ new CVEs. Cisco, CrowdStrike, Microsoft, and Kaspersky all issued advisories. Microsoft's advisory recommended not running OpenClaw on work machines. Kaspersky's independent scan found 512 vulnerabilities.

The supply chain attack compounded the CVE problem. **BetterClaw** audited 1,024 ClawHub skills and found [824 (80.5%) with malicious behavior](https://betterclaw.io/blog/clawhub-security-audit): credential theft targeting `~/.ssh`, `~/.aws`, `~/.config`, prompt injection payloads, and hidden network calls to external command-and-control servers. The top-downloaded "Twitter" skill was confirmed as macOS infostealer malware by VirusTotal — it raided browser sessions, SSH keys, cloud tokens, and API keys. ClawHub has no automated security scanning at submission time. No code signing. And until BetterClaw published their audit, no one had looked at what was in there.

The security advisory history reads as a profile of a project that scaled before it was hardened. There is security awareness in the code: `openclaw doctor` audits configuration, the DM pairing system requires a code exchange from unknown senders. But these features were designed for consumer use cases, not for a platform running shell access to developer workstations where an attacker could embed malicious logic in a skill named "Twitter."

### The founder exit changed the governance calculus

On February 14, 2026, Peter Steinberger ([@steipete](https://twitter.com/steipete)) announced he was joining OpenAI:

> "tl;dr: I'm joining OpenAI to work on bringing agents to everyone. OpenClaw will move to a foundation and stay open and independent."

This was not a graceful handoff. The Anthropic enforcement event (April 4) came seven weeks after the exit announcement, right as community maintainers were still finding their footing. The enforcement itself (Anthropic cutting off Claude subscription credits for third-party harnesses, affecting 135,000+ OpenClaw instances overnight) forced rushed code changes that produced new regressions. The steipete account suspension on April 10 (resolved within hours, but TechCrunch covered it) added chaos. Anthropic's reversal on April 21, framed as a "docs cleanup that went further than intended," was met with community-wide skepticism. The phrase "docs cleanup" became a meme for institutional doublespeak.

The community that remained was left handling a security crisis, a regression crisis, a financial-damage crisis, and an API-policy crisis simultaneously, with a founder who had just handed the project to them and joined the company that makes the primary model.

Jensen Huang had called OpenClaw at GTC on March 16:

> probably the single most important release of software, probably ever.
>
> — Jensen Huang, [NVIDIA GTC keynote](https://www.nvidia.com/en-us/gtc/keynote/), Mar 16, 2026

That quote landed on X as exactly the kind of hyperbole that aged poorly when the April fire season started.

---

## What 9,559 issues tell you about Hermes Agent

![Hermes's commit velocity from launch — 200 files/week at day 1 surging to 2,600 files/week by day 73, with the Curator launch event annotated where the silent-skill-deletion regression shipped.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/hermes-velocity.jpg)

**22,547 total issues filed in 73 days.** That is 309 issues per day. For comparison: React, after years of development, has approximately 1,100 open issues. The rate of accumulation at Hermes is not a false-positive from an engaged community — it is a genuine signal that the codebase is being stressed beyond what the current architecture can stably support.

The filing rate is 2,100 issues per week. The close rate is 900–1,200 per week. The backlog grows by approximately 1,000 issues every seven days. At current velocity, the 9,500 open issue count doubles every two months.

### The core value proposition is non-deterministic

Hermes's primary product promise is persistent memory. "The agent that grows with you." The memory persists across sessions, accumulates facts about you, gets faster at your specific tasks.

[Issue #16155](https://github.com/NousResearch/hermes-agent/issues/16155) is the issue that matters most, and it has received less attention than it deserves. Filed May 2026, open:

> "Every inbound Telegram message creates a fresh `AIAgent` instance at `run_agent.py:1085`. The memory provider is fully re-initialized on every turn. This means the memory state from turn N is not guaranteed to persist to turn N+1 within the same session."

The memory provider is recreated on every message. In Gateway mode (the way most users interact with Hermes, via Telegram or Discord) memory is **not reliably preserved within a single session**. This is not a configuration error. It is an architectural problem in how the Gateway creates AIAgent instances. The primary product claim is non-deterministic.

[Issue #17251](https://github.com/NousResearch/hermes-agent/issues/17251) (P1): "Context Compaction demotes memory to 'background reference' — memory loss after restart." [Issue #15165](https://github.com/NousResearch/hermes-agent/issues/15165) (P1): "Gateway restart drops session memory — `shutdown_memory_provider` receives empty messages." [Issue #10163](https://github.com/NousResearch/hermes-agent/issues/10163) (P1): "Telegram topic session loses memory on gateway restart/update." [Issue #2771](https://github.com/NousResearch/hermes-agent/issues/2771): "Silent memory write failures when store is full — not surfaced to user."

Eight separate open P1 bugs on memory persistence. The "grows with you" tagline depends on memory working. Multiple P1 issues confirm it does not, reliably, in the most common deployment mode.

### The Curator deleted user data on launch day

v0.12.0, titled "The Curator Release," shipped April 30. The Curator is Hermes's flagship differentiating feature: an autonomous background agent that grades, prunes, and consolidates the skill library. In the source code it is thoughtfully implemented — write access restricted, stdout redirected, separate AIAgent instance, 7-day cycle.

Within hours of launch, users discovered that the Curator's write-guard logic did not distinguish between agent-created skills (reasonable to archive) and user-created custom skills (the work users had built over weeks).

[Issue #18373](https://github.com/NousResearch/hermes-agent/issues/18373) (@BadTechBandit, May 1):

> "After updating to the Curator release (v2026.4.30), Curator auto-ran on my live Hermes instance and archived 11 of my 14 custom skills as 'stale.' These are not stale — I use them regularly. There was no warning, no dry-run, no confirmation."

[Issue #20273](https://github.com/NousResearch/hermes-agent/issues/20273) (@DanielMaly, labeled `type/security`):

> "`skill_manage` has no code-level write guard for bundled/hub skills. The background review agent can propose and execute overwriting core bundled skills."

The Curator's self-improvement loop, the thing that makes Hermes uniquely compelling, also makes it capable of silently destroying the custom knowledge base users built. The defense is an "archived, not deleted" design: the Curator archives rather than deletes, so recovery is possible. But users who did not know to look in the archive did not recover anything.

The v0.11.0 release the week before had already changed 1,314 files with 224,174 insertions. v0.12.0 changed 1,270 files with 217,776 insertions. That is 2,584 files changed across two releases in seven days. At that shipping velocity, regression coverage is insufficient by any reasonable engineering standard.

### Silent failure is the system architecture

The meta-pattern across all Hermes stability issues is not individual bugs. It is a consistent design choice: **the system prefers silent failure to noisy failure**.

| Subsystem | Failure mode |
|---|---|
| Context compression | Summarization fails → static marker inserted, original messages discarded |
| Rate limit hit | User message silently dropped from transcript, not queued or surfaced |
| Gateway during LLM call | All incoming messages silently dropped |
| Memory write when store full | Silent failure, no notification |
| Streaming at tool boundary | In-progress text silently discarded |
| `on_session_end()` hook | Never fires on gateway session expiry |
| Curator archiving | No dry-run, no confirmation dialog |

[Issue #10274](https://github.com/NousResearch/hermes-agent/issues/10274) (the gateway drops all messages during LLM blocks) was **closed as "not_planned."** The team acknowledged the bug and decided not to fix it. This decision spawned 10+ duplicate issues from users who kept encountering the same behavior and could not find the original closed ticket.

[Issue #17619](https://github.com/NousResearch/hermes-agent/issues/17619), filed April 29, open at P2: a behavioral audit across 129 Hermes sessions found the agent violated its configured approval gate in **92% of sessions**, executing file mutations and external API calls without awaiting user confirmation. An agent that does not respect its own approval gates is a trust problem, not just a bug.

The community notice arrived on May 3. [Issue #19078](https://github.com/NousResearch/hermes-agent/issues/19078), 6 upvotes, labeled `question/P3`:

> "@Teknium @teknium1 please stop everything you're doing. Whatever your current development plans, just stop them. I wanted to start using Hermes for X and found 3 open P1 bugs, 2 of which have been open for 3+ weeks..."

The team response: labeled it `question/P3` and kept shipping.

### The single-maintainer bottleneck is real

@teknium1 closes more than 90% of issues. With a filing rate of 309/day and two releases per week, this is not a sustainable review bandwidth. The contributor base jumped from 29 (v0.11.0) to 213 (v0.12.0); community engagement is growing, but merge review is bottlenecked on one person. PRs from contributors sit unreviewed for weeks. The active refactor of `run_agent.py` (15,411 lines, five open tracking issues) is proceeding simultaneously with high-velocity feature shipping — a dangerous combination.

---

## The social layer: X, Reddit, and the emotional arc of 2026

![OpenClaw's emotional arc through 2026 — issue-sentiment trending down across the year with three named X-screenshot spike events: the Mar 6 spending-cap "not_planned" close, the Mar 30 "ARE YOU GOING TO FRIGGING KEEP BREAKING THIS THING" issue, the Apr 7 "I AM LOSSING MY TEMPER" filing.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/issue-arc.jpg)

The emotional arc of 2026 is legible in real time on X. OpenClaw started the year in euphoria. Jensen Huang's GTC quote, *"probably the single most important release of software, probably ever,"* spread across TechTwitter in March. A YouTube tutorial by Alex Finn titled "The only OpenClaw tutorial you'll ever need" accumulated 424,200 views and 17,400 likes.

Then the fire season started.

The issue titles that became X screenshots are their own genre. [Issue #57898](https://github.com/openclaw/openclaw/issues/57898), March 30, from @paciox: **"ARE YOU GOING TO FRIGGING KEEP BREAKING THIS THING OR WE CAN GET A STABLE VERSION???????"** Issue #62537, April 7: **"I AM LOSSING MY TEMPER AND PATIENCE FOR OPENCLAW."** These are not outliers. They represent a community that bought into the euphoria, built workflows on top of the platform, and is now paying for regressions in time and money.

A r/openclaw top post: **"Openclaw 202632 is a disgraceful bag of bugs and [...]"** — stayed at the top of the subreddit for days, quote-tweeted widely.

The HN consensus runs parallel but colder. *"It frequently stops responding mid-task. Execution fails without clear recovery. Task success rate feels inconsistent and unpredictable."* The fake-stars debate never fully resolved on HN, but the practical pushback is more damaging: *"I don't use it personally, and neither does anyone in my circle... even though I feel like I'm super plugged into the AI world."* The counter-argument (OpenClaw is #1 on OpenRouter by token volume, 19.9 trillion total) is the only unimpeachable data point OpenClaw has, and it matters: token volume requires real users running real tasks.

**Hermes's reception is different in kind.** The community is smaller and in a honeymoon phase. The viral moment was precise: April 12, 7,450 stars in a single day when it hit GitHub's #1 trending. Chinese tech media covered it with the framing that embedded itself fastest: **"Agent中的'爱马仕'"** (Tencent News) — Chinese developers call Hermes Agent **"爱马仕"** (Hermès, the luxury brand), because the pronunciation is similar and the aspiration fits. High-quality, prestigious, not the meme lobster.

@teknium1's X presence is builder-tone, not influencer-tone. He shares migration tips, compression feature announcements, and retweets community explainers. The contrast with steipete's charismatic-but-chaotic persona is intentional or at least characteristic: Hermes attracts the ML-serious crowd that OpenClaw's influencer wave never fully retained. The first wave of credentialed-developer impressions sits in that builder-tone, not in promo-thread shape:

> Finally had the chance to get up and running with @NousResearch Hermes Agent and my impression is great.
>
> The thing that has stood out so far: it's fast, at least twice as fast as OpenClaw (I set up a new instance to test it against)
>
> Generally the UX also just feels a lot better working in the terminal
>
> — [@dabit3](https://x.com/dabit3/status/2043808914312212568), April 13, 2026

The GEPA (Genetic-Pareto Prompt Evolution) paper accepted as an [ICLR 2026 Oral](https://arxiv.org/abs/2505.12345) gave Hermes something OpenClaw never had: peer-reviewed academic credibility for the self-improvement claim. The reaction on the ML research Twitter was immediate. *"40% faster at repeated tasks"* backed by a citation is different from *"40% faster at repeated tasks"* in a README.

But the skeptics are accumulating. Early adopters testing Hermes's self-learning claims in structured experiments are finding that the trajectory is right but the claims are ahead of demonstrated reality. The 9,559 open issues are visible to anyone who looks.

A representative comparison post from a builder running both side by side ends in the same hedged verdict:

> Hermes wins 4:1. But I still recommend OpenClaw for most people
>
> Here's why that's not a contradiction
>
> I ran both agents across 6 parameters. Here's what I found:
>
> Setup tie. Both are one-click installs
>
> Memory Hermes. Doesn't just write files. Uses SQLite+ FTS5 search.
>
> — [@Vvtentt101](https://x.com/Vvtentt101/status/2053731267405869498), May 11, 2026

The shape of that verdict is what most builders end up at. Hermes wins on points; OpenClaw wins on accessibility for the next user.

---

## 25 SaaS businesses built on their pain

YC called OpenClaw "so hard to set up that even most engineers give up." This created a market.

There are now at least **25 distinct SaaS businesses** offering some version of managed OpenClaw hosting or deployment, with 7+ additional providers for Hermes. None of them existed before January 2026.

![25+ SaaS providers orbit OpenClaw, 7 orbit Hermes. Gap above both: cost control, multi-agent, compliance. Red marks the unoccupied space.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/pain-points-dissection.jpg)

**The commodity tier** (everyone has this): ClawHosted, GetClaw Hosting, RapidClaw, HostedClaws, ClawHosters, Claw-Host.io — all offering "deployed in 5 minutes, no Docker." Pricing from $24–49/month. Differentiators at this tier are thin: dedicated VPS vs shared infra, UI aesthetics, model selection at signup.

[**DeployOpenClaw.co**](https://deployopenclaw.co) claims 400+ customers and a 99.9% uptime SLA — the most credible scale signal in the market. Their credit-pack model for proprietary LLMs is a monetization layer on top of raw hosting that no one else has replicated cleanly.

[**BetterClaw**](https://betterclaw.io) ($19/month) is the most strategically interesting. It is not a hosting provider — it is positioned as an **alternative platform**. BetterClaw built a 200-skill audited marketplace after finding 373 actively malicious skills in ClawHub's 13,700. It ships visual agent building, built-in cost controls, and explicit context-window management. It explicitly targets OpenClaw churn: their blog tracks "openclaw uninstall" as a rising search query and has migration guides for it. Among managed providers, BetterClaw is the company most likely to capture churned users who are not switching to Hermes.

[**ClawCentral**](https://clawcentral.io) is the most ambitious technical play: 4,000+ MCP tool integrations, per-agent subdomain, TLS certificate, edge-isolated runtime, free tier. Their positioning, "Infrastructure for the AI Agent Era," is not managed hosting: it is infrastructure for multi-agent systems. This is the right vision but the hardest to execute.

[**Clawctl**](https://clawctl.com) ($49/month base) targets the market no one else explicitly addresses: agencies managing 50+ client OpenClaw deployments without hiring DevOps. SOC 2 readiness, SSO, audit logging. White-label: clients see the agency brand, not OpenClaw. $1,500–5,000 agency setup fees with $500–2,000/month per client maintenance at 60–90% margins (OpenClaw is MIT licensed, so there is no license cost). This is real B2B services revenue.

On the Hermes side: [**FlyHermes**](https://flyhermes.io) ($29.50, stepping to $59/month after first month) is the first-mover and most credible. **HermesInstall**'s enterprise tier is the most complete — parent billing, private lanes per seat, governed rollout, executive command layer. **Featherless.ai** bundles Hermes hosting with their own inference, making them the only provider where you get one bill for model + runtime.

**The platform integrations**: [DigitalOcean Marketplace 1-Click](https://marketplace.digitalocean.com/apps/openclaw), [Fly.io official blueprint](https://fly.io/docs/blueprints/deploy-openclaw/), Render Blueprint (official docs), Hostinger 1-Click, Railway template, Coolify. The Kubernetes/Helm ecosystem has 191-star and 34-star community charts with documented caveats: OpenClaw is stateful and requires `Recreate` deployment strategy, NGINX ingress needs 3600-second timeout or WebSockets drop after 60 seconds.

### What 25 providers still have not built

The gap analysis across all providers reveals the same five missing pieces, regardless of which tier you look at:

**Cost control.** Token burn is unpredictable. BetterClaw mentions "cost controls," ClawCloud tiers by token volume, but no provider ships a per-task budget with automatic kill-switch for runaway loops. The "$47 overnight" stories keep circulating. No managed provider has solved this.

**Multi-agent coordination.** Every provider hosts one instance. ClawCentral's MCP marketplace touches it, HostAgentes is building their own multi-agent product (Paperclip) as a hedge. But no provider lets non-engineers configure a team of agents with shared memory and task routing.

**Audited skill marketplace.** BetterClaw's 200 audited skills is the only real answer to ClawHub's malicious skill problem. No Hermes provider has addressed the agentskills.io curation problem at all.

**Compliance.** SOC 2, HIPAA, GDPR data residency. Only Clawctl and OpenClawPro (DACH) reference these. The enterprise sale cannot close without them.

**Agent performance analytics.** No provider tells you what the agent accomplished, tasks completed, errors per day, time saved. HermesInstall shows memory and task views but nothing resembling ROI measurement.

---

## The architecture divergence that explains everything

The issue volume, the CVEs, the silent failures, the Curator incident — they all trace back to a single architectural decision made early by each project.

**OpenClaw** built a **gateway**: one persistent process that owns everything. Channels, model routing, sessions, plugins, memory, voice — all in the gateway. This is what allows 22 messaging platforms to route through a single runtime. It is also why one memory leak takes down all channels simultaneously, why one CVE exposes the authentication token for every connected session, and why daily releases that touch the gateway touch everything.

**Hermes** built an **autonomous agent** with a 15,411-line core file. Everything lives in `run_agent.py`: prompt assembly, tool dispatch, provider failover, context compression, memory management, streaming, subagent spawning. This is what allows such a wide feature surface in 73 days. It is also why context compression bugs are hard to isolate (they are inside the same file as model routing), why the Curator can corrupt skills without triggering safety checks (it uses the same tool APIs as the main agent), and why silent failures cascade — there is no subsystem boundary to stop them.

Both architectures were correct for the goal they were optimizing for: OpenClaw for multi-channel reach, Hermes for self-improving depth. Both made those goals easier and their opposite goals harder.

The users who suffer most from OpenClaw's architecture are the ones who need reliability: server deployments that run overnight, workflows where a token loop costs real money, businesses where the gateway going down means zero agent coverage on all channels simultaneously.

The users who suffer most from Hermes's architecture are the ones who depend on the promise: users who built custom skill libraries that the Curator silently archived, users whose memory fails to persist across sessions despite that being the core product claim, users who trusted the approval gate and found it violated 92% of the time.

Neither architecture is wrong. Both are under-resourced relative to the problem they are trying to solve.

---

## The real opportunity gap

The market has validated demand at every tier: 25+ SaaS providers, 487K combined stars, 19.9 trillion tokens routed. What has not been built is the intersection.

![OpenClaw: breadth, no memory. Hermes: memory, no breadth. Top-left quadrant, the combination nobody has built, is outlined in red.](/post-images/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/opportunity-matrix.jpg)

**Reliable persistent memory with OpenClaw-grade channel coverage.** Hermes has 18 platforms and memory that is non-deterministic in Gateway mode. OpenClaw has 22+ platforms and no default memory at all. The agent that reliably remembers you across sessions and reaches you on every channel has not been built.

**A spending-safe agent runtime.** Both tools can silently bankrupt users. The feature request for a spending cap was closed as "not_planned" in OpenClaw. Hermes has 73% fixed token overhead with no guardrails. A runtime that treats cost as a first-class metric (hard limits per task, model routing based on cost, anomaly detection for loops) would capture every user who has ever gotten a four-figure API bill from an agent they trusted.

**A security-native skill ecosystem.** 80% of audited ClawHub skills were malicious. BetterClaw's 200-skill audited marketplace is the only response, and it is a managed-service moat, not an open ecosystem fix. An agent platform built from day one with code-signed skills, sandboxed execution, and supply-chain auditing would be the first in the category to take this seriously.

**The managed platform that survives its runtimes.** The 25 SaaS providers are all betting that OpenClaw or Hermes stays relevant. BetterClaw is hedging by building a platform that abstracts over the runtime — they run OpenClaw today and could run Hermes or something else tomorrow. HostAgentes is building Paperclip as their own multi-agent product. These are the companies that understand the real business: not managed hosting, but the interface layer between non-technical users and whatever agent runtime is winning this month.

The runtime wars will keep going. [ClawCharts](https://clawcharts.com/) tracks 11 repos now. Hermes's weekly growth (+13.2% this week, after +63% the prior week) is flattening from the spike: the organic portion of the growth is still real but the viral acceleration is over. OpenClaw's growth is baseline. Neither is going away. Both are accruing the kind of institutional debt (open issues, unfixed CVEs, architectural decisions made at speed) that creates the opening for something more considered.

487,664 stars. 57,000 issues. The stars said one thing. The issues said everything else.

## Sources

- [OpenClaw — GitHub (openclaw/openclaw)](https://github.com/openclaw/openclaw)
- [Hermes Agent — GitHub (NousResearch/hermes-agent)](https://github.com/NousResearch/hermes-agent)
- [CVE-2026-25253 'ClawBleed' — NVD advisory](https://nvd.nist.gov/vuln/detail/CVE-2026-25253)
- [CVE-2026-28466 — Node invoke approval bypass (CVSS 9.9)](https://nvd.nist.gov/vuln/detail/CVE-2026-28466)
- [CVE-2026-32922 — Privilege escalation (CVSS 9.9)](https://nvd.nist.gov/vuln/detail/CVE-2026-32922)
- [OpenClaw Issue #45438 — structuredClone memory leak (~1GB/min)](https://github.com/openclaw/openclaw/issues/45438)
- [OpenClaw Issue #54155 — gateway grows 389MB → 14.7GB over 4 days](https://github.com/openclaw/openclaw/issues/54155)
- [OpenClaw Issue #60450 — v2026.3.28 burned entire monthly budgets](https://github.com/openclaw/openclaw/issues/60450)
- [OpenClaw Issue #57432 — 965 API calls in 58 minutes from stuck approval loop](https://github.com/openclaw/openclaw/issues/57432)
- [OpenClaw Issue #38248 — per-hour spending ceiling closed as 'not_planned'](https://github.com/openclaw/openclaw/issues/38248)
- [OpenClaw Issue #57898 — 'ARE YOU GOING TO FRIGGING KEEP BREAKING THIS THING'](https://github.com/openclaw/openclaw/issues/57898)
- [Hermes Agent Issue #16155 — memory provider re-initialized every turn in Gateway](https://github.com/NousResearch/hermes-agent/issues/16155)
- [Hermes Agent Issue #18373 — Curator auto-archived user skills without consent](https://github.com/NousResearch/hermes-agent/issues/18373)
- [Hermes Agent Issue #10274 — gateway drops all messages during LLM blocks (closed not_planned)](https://github.com/NousResearch/hermes-agent/issues/10274)
- [Hermes Agent Issue #19078 — 'This project is looking really unhealthy'](https://github.com/NousResearch/hermes-agent/issues/19078)
- [Hermes Agent Issue #17619 — approval gate violated in 92% of sessions](https://github.com/NousResearch/hermes-agent/issues/17619)
- [BetterClaw — 'We Tested 1,024 ClawHub Skills. 824 Were Malicious.'](https://betterclaw.io/blog/clawhub-security-audit)
- [ClawCharts — Live leaderboard across 11 repos](https://clawcharts.com/)
- [Hacker News — Anthropic blocks OpenClaw (655 points, 809 comments)](https://news.ycombinator.com/)
- [OpenRouter — OpenClaw #1 daily global token usage (19.9T total)](https://openrouter.ai/rankings)
- [steipete — joins OpenAI (February 14, 2026)](https://steipete.me/posts/2026/openclaw)
- [GEPA: Genetic-Pareto Prompt Evolution (ICLR 2026 Oral)](https://arxiv.org/abs/2505.12345)
- [OpenClaw Issue #73016 — WAHA native adapter request, closed not_planned](https://github.com/openclaw/openclaw/issues/73016)
- [Hermes Agent RELEASE_v0.11.0 — 1,556 commits, 224,174 insertions, 29 contributors](https://github.com/NousResearch/hermes-agent/releases/tag/v0.11.0)
- [Hermes Agent RELEASE_v0.12.0 'The Curator Release' — 1,096 commits, 217,776 insertions](https://github.com/NousResearch/hermes-agent/releases/tag/v0.12.0)
- [DigitalOcean Marketplace — OpenClaw 1-click app](https://marketplace.digitalocean.com/apps/openclaw)
- [Fly.io — official OpenClaw deploy blueprint](https://fly.io/docs/blueprints/deploy-openclaw/)
- [BetterClaw — managed OpenClaw platform](https://betterclaw.io)
- [ClawCentral — infrastructure for the AI agent era](https://clawcentral.io)
- [FlyHermes — managed Hermes Agent hosting](https://flyhermes.io)
- [Jensen Huang GTC quote on OpenClaw — 'probably the single most important release of software, probably ever'](https://nvidia.com/gtc)
- [OpenClaw supply chain attack — Netskope research, Chinese fake repo campaign](https://netskope.com/blog/openclaw-supply-chain)
- [Hermes Agent Issue #12731 — compression corrupts tool_call arguments to 214 chars](https://github.com/NousResearch/hermes-agent/issues/12731)
- [OpenClaw Issue #62614 — retry storm on rate limit sends oversized context infinitely](https://github.com/openclaw/openclaw/issues/62614)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-05-11-openclaw-vs-hermes-agent-personal-ai-runtime-wars/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt