6defe7eb6c (reviewed August 27, 2026), not a live adversarial test or a guarantee about every deployment.
Source findings. Hermes’s security policy treats authorized callers within an adapter as equally trusted; their configured tools can include shell access. Its command guards include hardline and configured deny rules before smart review on host-reaching backends. Cron and single-query contexts default to denying commands that require approval, while other non-interactive contexts can still auto-approve. Its Codex adapter reuses a thread within a running agent and supports steering, but starts a new native thread after process restart; user turn input is text-only. A curated MCP bridge exposes Hermes tools to Codex, excluding tools that require the running Hermes agent-loop context.
Historical reports. A user-posted static-analysis audit of Hermes v0.8.0 classified four findings as critical and nine as high; those are the reporter’s classifications, not verified current-head vulnerability counts. The cited updater failure and gateway memory leak were closed with maintainer comments recording fixes. Third-party CNA records, including CVE-2026-14625, report vendor non-response; that statement is the CNA’s account, not an independent finding of this review.
Hermes’s built-in memory store removes entries without source-session tombstones. A later write can add the same fact again; this is a limitation inferred from the store contract, not a reproduced model-driven resurrection. Autonomous memory writes are enabled by default, with an optional approval gate. Hermes also provides atomic credential writes, import-frozen redaction, child-environment scrubbing, and session attribution in its SQLite store.
Both projects support many model providers and channels. Counts are not directly comparable: catalogs mix vendors, authentication routes, transports, and plugin distribution types. OpenClaw’s catalog includes Nextcloud Talk, generic Nostr, Twitch, Urbit, and three Zalo connection paths; Hermes’s Nostr integration is Buzz-specific and supports self-hosted relays. Check the current catalogs for the exact integration and maintenance model you need.
Integration choices. Hermes includes SimpleX, ntfy, and conversational email adapters (IMAP polling, threaded SMTP replies), plus Home Assistant state-change subscriptions. OpenClaw handles email as automation: the bundled IMAP trigger routes authenticated inbound mail into an isolated session using the selected reader agent’s tool policy. The documented setup configures a restricted reader; isolation alone does not restrict its tools. Gmail push provides a separate Gmail automation path, with sending through skills. Hermes’s email adapter checks sender authorization and authentication by default, then routes messages into per-sender conversations with the configured core toolset. Both projects support third-party integrations; evaluate the adapter, its defaults, and who maintains it rather than inferring completeness from a feature count.
Hermes also has opt-in session pruning and OTLP gateway monitoring export, separate from its Langfuse tracing. Its updater fast-forwards a selected Git branch and can roll back when critical-file syntax checks fail. These controls should not be omitted when comparing OpenClaw’s release channels and audit architecture.
In the separately reviewed August 28, 2026 snapshot, Hermes defaults to persistent kernels for local Python execution and attempts persistent kernels for remote execution, falling back to per-call execution when a remote kernel is unavailable. The former
code_execution.kernel_mode setting is ignored. Remote reuse also depends on task identity; reset: true discards kernel state, and state is not restored after Hermes restarts.