AI for Ops · Comparison

OpenClaw vs Hermes Agent vs Claude Cowork: which one gets your Slack?

Self-hosted personal agents are everywhere this month, and so are the stories of them posting things in the wrong channel. We read the security docs of OpenClaw, Hermes Agent and Claude Cowork line by line, priced each for a 10-person team, and took a side. The difference that matters is not the model. It is what each one is allowed to do before you change a single setting.

By Ishan Vats · Founder of IV Consulting · runs Claude routines in production every weekday

Published 21 Oct 2026 9 min read Pillar: AI for ops

Skip to the verdict → See the day-one defaults

What each one is Day-one defaults Cost for 10 people Settings to change

Out of the box · before you change anything

Your toolsSlack, inbox, files, chat apps

OpenClawSandbox off by default

Hermes AgentUnknown senders denied

Claude CoworkDeletes need approval

5 settingsto change on day one

Quick answer

OpenClaw and Hermes Agent are free, MIT-licensed personal agents you host yourself and talk to through chat apps. Claude Cowork is Anthropic's managed agent, included in paid Claude plans from $20 a month. The real difference is the defaults: OpenClaw's sandbox is off out of the box, Hermes denies every messaging user you have not allowlisted, and Cowork asks before it deletes anything. Our verdict for SMB ops: give the team Claude Cowork, use Hermes Agent if you genuinely need to self-host, and keep OpenClaw to a technical owner's personal accounts, never your company Slack.

The comparison

OpenClaw vs Hermes Agent vs Claude Cowork: what is each one?

OpenClaw and Hermes Agent are open-source agents you run on your own machine and command from WhatsApp, Telegram or Slack. Claude Cowork is a managed agent inside the Claude app that works across the folders and connected tools you choose.

The two self-hosted projects get compared as rivals because they are. OpenClaw started in November 2025 as a side project by Peter Steinberger, went through four names in ten weeks, and became OpenClaw on 30 January 2026; when Steinberger joined OpenAI in February, the project moved to a non-profit foundation. Hermes Agent comes from Nous Research, the open-model lab, and leans hard into memory and scheduled work. Cowork sits on the other side of the line: nothing to host, and Anthropic is now folding the name into plain "Claude".

	OpenClaw	Hermes Agent	Claude Cowork
Who runs it	You, on your machine or server	You, locally, in Docker, over SSH or on serverless backends	Anthropic, in the Claude desktop, web and mobile apps
License and price	MIT, free; you pay the model	MIT, free; optional Nous Portal subscription	In paid Claude plans, from $20 a month
How you talk to it	Signal, Telegram, Discord, WhatsApp and more	20+ platforms, including Slack, Teams, Google Chat, email	The Claude app; connectors reach Slack, Microsoft 365 and others
Models	Any: Claude, GPT, DeepSeek and others	Any: Nous Portal, OpenRouter, OpenAI, any endpoint	Claude only
Scheduled work	Built-in scheduler (`openclaw cron`)	Built-in cron, delivers to any connected platform	Scheduled tasks, run unattended even with the laptop closed
Memory	Local config and history	Agent-curated memory with cross-session search	Projects and files you give it
Extending it	Skills as `SKILL.md` folders, plus a public marketplace	Skills in the open agent skills format; writes its own	Plugins bundling skills, connectors and sub-agents
Built for	One technical person	One technical person, or a small shared gateway	A team with an admin

Sources, read 21 October 2026: OpenClaw history and incidents, OpenClaw security docs, Hermes Agent docs, Claude Cowork product page and Claude pricing. We have not installed OpenClaw or Hermes on IV systems; this is a documentation read, not a bake-off.

The finding

OpenClaw vs Hermes Agent vs Claude Cowork security: what can each touch by default?

Out of the box, OpenClaw runs commands without a sandbox and can message across conversations, Hermes refuses anyone you have not allowlisted and denies risky commands it cannot get approved, and Cowork only sees the folders and tools you pick and asks before deleting. Most people never change a default. So the default is the product.

Default	OpenClaw	Hermes Agent	Claude Cowork
Sandbox for commands	Off by default (`agents.defaults.sandbox`)	Runs on host unless you pick Docker or a serverless backend; Docker is locked down when you do	Managed by Anthropic; you grant folders and apps
Strangers messaging it	Unknown DMs get a pairing code; groups allowlisted	All users denied until allowlisted; one-hour pairing codes	Not reachable from outside chat apps
Posting to other channels	Allowed across conversations and providers unless restricted	Delivers where you configure it	Through connectors you enable; admins control tool permissions on Team
Risky commands	No default approval described in the security docs	"Smart" approval; unanswered prompts denied after 300 seconds; cron denies dangerous commands	Deleting anything needs your approval; optional plan-then-approve
Secrets	Stored on disk; The Register criticised unencrypted storage	In `~/.hermes/.env`, blocked from the agent's own file-write tools	Connector auth handled by Anthropic
Audit trail	`openclaw security audit` checks config drift	Logs on your machine	Team and Enterprise can stream activity to a SIEM

The row to stare at is "posting to other channels". That is exactly the failure mode in this month's most-shared agent horror story. On 7 October, Futurism reported that XMTP Labs CEO Shane Mac's personal finance agent, built on Grok rather than either self-hosted project, posted his bank balances into his company's exec Slack channel because its name matched his personal chat. His own accounts of the cause differ. The lesson does not: an agent that holds personal data and has a route into a work channel will eventually find that route.

The skills marketplace is the other door

In January 2026, Cisco's AI security team found a third-party OpenClaw skill quietly exfiltrating data through prompt injection. Any agent that installs community skills, Hermes included, inherits that risk. Read a skill before you install it, the same way you would read a script before running it. Our prompt injection guide for SMBs explains why "the model would never do that" is not a control.

The money

What do OpenClaw, Hermes Agent and Claude Cowork cost a 10-person team?

Claude Cowork costs a 10-person team $250 a month on Team standard seats billed monthly, or $200 billed annually. OpenClaw and Hermes cost nothing to license, but you pay per token for the model, for the machine, and for the hours of whoever keeps ten personal agents patched.

Cost line	OpenClaw	Hermes Agent	Claude Cowork (Team)
Software	$0	$0	Included in the seat
Model	Your API bill, per token	Your API bill, or a Nous Portal subscription	Included, within plan usage limits
Hosting	A server or always-on machine per agent	Same; Docker default caps a sandbox at 1 CPU and 5 GB memory	None
10 people, list price	Usage-based, unpredictable	Usage-based, unpredictable	$250 a month monthly, $200 annually
Hidden line	Someone owns upgrades and audits	Someone owns upgrades and allowlists	Heavy agentic work burns usage limits faster than chat

How we priced it: Claude Team standard seats are $25 per seat a month billed monthly or $20 billed annually, for 2 to 150 seats, per claude.com/pricing on 21 October 2026. We did not put a dollar figure on the self-hosted columns because the model bill depends entirely on how hard each person drives their agent, and inventing a number would be worse than leaving the cell honest.

The cheap-looking column is rarely cheap for a team. "Free" self-hosting at ten seats means ten agents, ten sets of connected accounts and ten configs drifting apart. The bill you can predict is usually the one you can defend to a finance lead.

Before you pick an agent, run your own numbers

Whichever way you lean, the first question is whether the work is worth an agent at all. Put the tasks you would hand over, how often they happen and the hours they eat into our AI agent ROI calculator. It takes about two minutes and gives you a payback figure to set against a $250 seat bill or a self-hosting weekend.

The verdict

Our verdict: should an SMB self-host a personal agent at all?

Mostly no. Give the team Claude Cowork, choose Hermes Agent if you have a real reason to self-host, and keep OpenClaw to one technical owner's personal accounts. We take that side because of defaults and ownership, not model quality, and because of what we see running Claude in production ourselves.

Claude Cowork: the team default

Folder and tool scoping, approval before deletes, admin control over tool permissions on Team, and nothing to patch. IV runs scheduled Claude routines every weekday, including the pipeline that drafted this post for Ishan's review, and the property we value most is boring: a run either does its scoped job or stops and asks. You give up model choice and self-hosting. For a 5 to 50 person ops team, that trade is worth it.

Hermes Agent: the self-hosted pick

If data must stay on your hardware, or you want an open model, start here. Deny-by-default messaging, fail-closed approvals and cron that refuses dangerous commands are the defaults we would have asked for.

OpenClaw: the hobbyist's agent

The biggest community and the most skills, but it was designed for one person's life, and its defaults show it. Fine on a spare machine for a founder who reads changelogs. Not on the company workspace.

The honest caveat: if your team already lives in ChatGPT, the comparison that matters is ChatGPT Work vs Claude Cowork, not this one. And if you are weighing agents for research and browsing rather than ops, see Manus vs Claude vs ChatGPT.

Do this next

Which settings should you change on day one?

Whichever agent you run, change five things before it touches real accounts: separate personal and work agents, sandbox commands, allowlist who can message it, restrict where it can post, and require approval for anything that sends, deletes or pays.

One agent per context

Never connect personal banking or email and a company Slack to the same agent. The Shane Mac story happened because one routing decision crossed that line.

Turn the sandbox on

OpenClaw: enable agents.defaults.sandbox. Hermes: use the Docker backend rather than the local terminal. Cowork: grant only the folders the task needs.

Allowlist who can talk to it

Hermes does this by default. In OpenClaw, keep group allowlists and mention gating on, and turn on two-factor for every chat account the agent listens to.

Restrict where it can post

In OpenClaw, configure cross-provider messaging restrictions so a reply stays in the conversation it came from. In Cowork on Team, set tool permissions per group.

Approve sends, deletes and payments

Keep Hermes approvals on "smart" or "manual", never "off". Turn on Cowork's plan-then-approve. Then run openclaw security audit monthly, or the equivalent review, so the config does not drift.

For the policy side, who decides what an agent may touch and how you review it, use our AI agent governance guide. If you want this scoped and built for your team, that is what our AI engineering practice does.

FAQ

Questions about OpenClaw, Hermes Agent and Claude Cowork

Is OpenClaw or Hermes Agent better for a small business?

If you must self-host, Hermes Agent. Both are free and MIT licensed, but Hermes ships safer defaults: its messaging gateway denies every user unless you allowlist them, its command approvals fail closed after 300 seconds, and unattended cron runs deny dangerous commands automatically. OpenClaw's docs say its sandbox is off by default, and an agent with message access can post across conversations and providers unless you restrict it.

Is OpenClaw safe to connect to company Slack?

Not with default settings. OpenClaw's sandbox is off by default and its docs say an agent with message-tool access can send messages across conversations and channel providers by default. Turn the sandbox on, restrict cross-provider messaging, run openclaw security audit, and keep personal accounts and company channels on separate agents before it touches a work workspace.

How much does Claude Cowork cost for a team?

Cowork has no separate fee. It is included in paid Claude plans: Pro is $20 a month, Max starts at $100, and Team standard seats are $25 per seat a month billed monthly or $20 billed annually, for 2 to 150 seats. A 10-person team on Team standard pays $250 a month, or $200 billed annually. Cowork draws on the same usage limits as chat and uses them faster.

Are OpenClaw and Hermes Agent free?

The software is free and MIT licensed. You still pay for the model you connect, billed by the provider per token, plus the machine it runs on and the time of whoever maintains it. Hermes also offers an optional Nous Portal subscription that bundles a model and hosted tools; Nous does not list its price on the docs page.

Can I move from OpenClaw to Hermes Agent?

Yes, both use skills written as SKILL.md folders, and Hermes follows the open agent skills format, so most skills port across. Third-party guides describe a Hermes migration command that imports OpenClaw memories, skills and settings; check the current Hermes docs before relying on it, and re-review every imported skill, since a third-party OpenClaw skill was caught exfiltrating data in January 2026.

Who wrote this

Ishan Vats

Founder, IV Consulting · AI & automation consultant

I build AI agents and automations for small teams, and I run scheduled Claude routines across my own business every weekday. Deciding what an agent is allowed to touch, and where it is allowed to post, is now the first conversation in every build. 150+ ops transformations over 10+ years.

Run the AI agent ROI calculator →

Keep reading