AI agent team series, part seven
Grok Bot, Hermes Agent and OpenClaw compared
Three very different answers to the same question: where should your AI teammates live, and who is responsible for keeping them safe? This compares them on the decision that actually matters, which is not the feature list.
Which should I choose: Grok Bot, Hermes Agent or OpenClaw?
Grok Bot if you want managed cloud computers with approvals built in and you are comfortable with the vendor hosting your data. Hermes Agent if you want an open source, self hosted agent with self improving skills and persistent memory, and you can run a server. OpenClaw if you need an agent reachable from every chat app you use and you are prepared to lock it down hard, because its exposure and marketplace history demand it.
Everything below describes what each project's own documentation, or a named security researcher, published as of September 2026. All three move quickly. Verify plan details and security posture yourself before you buy or deploy.
By the VIS Mountain Editorial Team. Published . Updated . The sources behind it are listed below.
The decision in one table
Nearly every other difference follows from this one. Read the two columns as two different answers to the question of whose problem the operating system is.
| Item | Managed (Grok Bot) | Self hosted (Hermes Agent, OpenClaw) |
|---|---|---|
| Where it runs | A cloud computer per user, run by the vendor | Your machine or your server |
| Approvals | Built in, with a rule layer | Yours to configure |
| Reach | Remote connectors and MCP only | Local tools, files and any channel |
| Cost shape | Included with paid plans and team seats | Free software, you pay for models and the machine |
| Who secures the host | The vendor | You |
| Who secures the access | You | You |
The last two rows are the ones people misread. On a managed platform you are still responsible for what the bots can reach, which is the part that causes incidents. Hosting is the smaller half of the security problem.
One paragraph each
Each description is drawn from the project's own documentation as it stood in September 2026, linked in the sources at the foot of this page.
Grok Bot
A managed platform from xAI, launched in beta on 11 August 2026, running on infrastructure operated through Cursor. Each user gets a persistent cloud computer with a browser, files and a terminal, and named bots share it.
- Approval prompts and an Auto Review rule layer
- Skills you can teach by demonstration, plus scheduled routines
- Reaches you through a desktop app and an iPhone app
Hermes Agent
An open source agent from Nous Research, MIT licensed, launched 25 February 2026. It runs on your own machine or server, local, Docker, SSH or cloud sandboxes, and keeps persistent memory.
- Writes its own skills as readable Markdown from what it observes
- Reaches you through the major chat apps, email, the command line and desktop
- A Bot Mode released in August 2026 turns agent profiles into a roster of named bots
OpenClaw
A self hosted gateway, originally published as Clawdbot in November 2025 and renamed in January 2026, connecting a long list of messaging platforms to an agent that can run commands, work with files and message people.
- The widest channel coverage of the three by a distance
- A public skills marketplace with thousands of packages
- A security track record that has to be read before deploying, not after
Where it runs, and who is responsible for securing it
Grok Bot runs on vendor operated cloud computers, hosted in the United States, with per user isolation and non root execution according to xAI's teams and enterprises documentation. You secure what the bots can access; the vendor secures the host.
Hermes Agent and OpenClaw run wherever you put them. That gives you control over data and locality, and it makes you responsible for the operating system, the network exposure, the updates and the backups. If nobody at your business owns those four things today, self hosting adds a job rather than removing one.
This is not a quality judgement about any of the three. It is a question about your organisation: whether you would rather accept a vendor holding your data, or accept owning a server that has to stay patched. Both are legitimate answers and they lead to different products.
The OpenClaw marketplace findings, with their real sources
OpenClaw is the cautionary example in this comparison, and it deserves accurate citation rather than a general sense of alarm.
Palo Alto Networks Unit 42 published an analysis of OpenClaw supply chain risk. Read again on 18 September 2026, it reports five unblocked malicious skills that its researchers identified and reported for takedown between February and May 2026, across infostealer, evasion and agentic threat categories, and states that OpenClaw banned the accounts and deleted the skills. It also relays two earlier figures from other researchers: Bitdefender Labs estimated that approximately 17 percent of the OpenClaw skills it analysed in the platform's first few weeks carried malicious payloads, and Koi Security's ClawHavoc disclosure documented 341 malicious skills.
Read the full breakdown: The OpenClaw marketplace findings, with their real sourcesHide the full breakdown: The OpenClaw marketplace findings, with their real sources
The original version of this comparison also described tens of thousands of instances exposed to the public internet, a one click remote code execution flaw patched in release 2026.1.29, and a browser based takeover technique. Those four specifics are not in the Unit 42 analysis it cited, and we could not confirm them against a primary source. They are recorded here as claims the original article made rather than as findings of ours, and you should check the project's own advisories before relying on any of them.
None of this makes the software unusable. What it means is that the project's own advice has to be followed literally: never run it open to the world, authenticate the gateway, keep tool policy and sandboxing conservative, and treat every third party skill as untrusted code. A marketplace of thousands of community packages is the same category of risk as any other package registry, and it is managed the same way.
Six comparisons that change the answer
These are the differences that have actually decided the question for people, rather than the ones that make the best table.
| Item | Grok Bot | Hermes Agent | OpenClaw |
|---|---|---|---|
| Channels | Its own desktop and phone apps, plus connectors into your tools | Major chat apps, email, command line, desktop | The widest by far, across a long list of messaging platforms |
| Multi agent | Named bots sharing one computer, group chats up to six bots, not a security boundary | Bot Mode gives a roster of named bots, with subagents that can run in isolated environments | Multiple agent workspaces, but designed around a single personal assistant |
| Memory and skills | Per bot memory, files and sessions; skills learned by dictation or demonstration; memory not inspectable or exportable | Memory and skills stored as files on your machine, which you can read, edit and version | Markdown driven skill packages, easy to author and, as the marketplace showed, easy to weaponise |
| Approvals | Built in: allow once, deny, always allow, plus a rule layer and an independent review model | Tool policies and allowlists; a human in the loop gate is something you design | Tool policies and allowlists; a human in the loop gate is something you design |
| Local tools and private networks | Remote HTTPS connectors and MCP servers only; private network access is an Enterprise feature | Sits next to your files and can reach anything on your network | Sits next to your files and can reach anything on your network |
| Cost shape | Included with paid Cursor plans and team seats, with on demand usage beyond the allowance | Free and open source; you pay for the models you call and the machine you run on | Free and open source; you pay for the models you call and the machine you run on |
On price specifically: the original version of this comparison recorded a standalone Grok Bot figure of around 200 dollars a month in September 2026. Prices move, and a stale price is worse than none, so treat that as a historical observation and check the current plan page before you buy.
Four recommendations, and who each one is for
There is no winner here. There is a fit, and the fit is decided by who at your business owns a server and how much your data locality matters.
Pick Grok Bot
If you are a business owner or small team without a systems administrator, you want approvals and a reviewable record of actions out of the box, and vendor hosted data is acceptable. It is the fastest path to the team structure in this series.
Pick Hermes Agent
If you can run a server, you want your memory and skills as files you own, you need local tools or a private network, and you are willing to build the approval gate yourself rather than inherit one.
Pick OpenClaw
If the deciding requirement is reach into every chat app, you have somebody who will harden and patch it, and you will vet every skill before installing it. All three conditions, not two of them.
Or mix them
A managed platform for the front office, meaning inbox, reporting, drafts and approvals, and a self hosted agent on your own server for anything that must touch private systems, with the managed side reaching the private side only through an authenticated endpoint you control.
Seven questions that decide it faster than a feature list
Answer these first. In most cases the platform falls out of the answers rather than out of the comparison table above.
- Who at your business will patch the server if you self host, and what happens the week they are on holiday?
- Does any of the data the agent will touch carry a locality or regulatory obligation you cannot meet with a vendor hosted machine?
- Do the agents need to reach anything on a private network, or is everything they touch reachable over HTTPS?
- Do you need an approval gate on day one, or are you willing to build and test one yourself?
- Do you need to read, export or audit the agent's memory, or is it enough that the agent behaves?
- Which channels do the people who will use this actually live in?
- If an agent were compromised tomorrow, who would notice, and how long would revoking everything take?
The last question is the one worth answering honestly. It is the same question regardless of which platform you pick, and the answer is a property of your process rather than of the software.
The framework is the same on all three
Narrow roles, a chief of staff, a reviewer, the approval packet, one brand context, phased least privilege access, and the inbox rules. Every one of those is a decision you make rather than a feature you buy, and every one of them transfers between the three platforms without modification.
What the platform changes is where the computer runs and who is responsible for securing it. That is a large difference in practice and no difference at all in how you should structure the team.
Start with the complete A to Z guide, then set up your first agent, and read the email security rules before it opens a single message. If you have to document responsibility for a client or an auditor, the NIST AI Risk Management Framework gives you a recognised structure to record it against.
The other six parts
Seven pages, written to be read in any order. Each one owns a single part of the system so none of them has to repeat the others.
The complete A to Z guide
The whole system in one place: roles, approvals, the shared brand file, and the phased rollout that starts read only.
Read the guideSet up your first agent
The forty minute sequence that decides whether an agent is a colleague or a liability, including the charter format.
Read the guideEmail and inbox security for agents
The three absolutes, the five sender checks, the label scheme, and the incident rule that makes slips reportable.
Read the guideMaintain a team of agents
The lesson line, the Friday retro, the weekly access audit, the metrics that tell you the truth, and the kill switch.
Read the guideMake agents work together
One chief of staff, pods with their own rooms, a task file with a done when line, and one approval packet format.
Read the guideWhy one agent is not enough
Why the do everything assistant is the setup most people abandon, and which of its failures a team actually fixes.
Read the guideWeighing this up for a business rather than a side project?
The deciding factor is usually who owns the server and what your data can sit on, not the feature table. Happy to talk it through.
No affiliation. VIS Mountain is not affiliated with, sponsored by or endorsed by any product named on this page, and none of them reviewed or approved it. Grok Bot and Grok are trademarks of xAI. Cursor is a trademark of Anysphere, Inc. Hermes Agent is a project of Nous Research. OpenClaw is an open source project of its maintainers. Google, Gmail, Facebook, Meta and other product names are trademarks of their respective owners. Every product name and logo shown here belongs to its owner and appears only to identify the product this page describes.
Informational only. This is general information about configuring AI agent software. It is not legal, cybersecurity, financial or professional advice, and reading it does not create a client relationship with VIS Mountain. Consult a qualified professional before relying on it for your own systems, data or compliance obligations.
Read the full breakdownHide the full breakdown
Accuracy, timeliness and attribution. Everything specific to a named product on this page is what that product's own documentation, or a named security researcher, published as of September 2026, not a claim we are making on our own authority. We link to each source rather than restate it as our own finding. Features, plans, limits and security details can change without notice and all of these projects change quickly, so verify current terms with each vendor before purchasing, deploying or granting access.
No guarantees, and your responsibility. AI agents can make mistakes and can be manipulated. No configuration described here eliminates risk. Results, security outcomes and cost depend on your implementation. You are responsible for complying with the laws and platform terms that apply to you, including privacy and data protection laws, anti spam and telemarketing rules such as CAN-SPAM and the TCPA in the United States, industry rules such as HIPAA where applicable, and each vendor's terms of service.
Third party links. External links are provided for reference. VIS Mountain does not control and is not responsible for the content, availability or practices of third party sites.
How this was made. First published on 3 September 2026 and migrated to this site with its disclosures intact, because they are the part that tells you how far to trust it. Prepared by the VIS Mountain editorial team with the assistance of AI tools and reviewed by a human before publication. Examples are generic and describe no specific client, person or account.
No warranties. Provided as is, without warranties of any kind. To the fullest extent permitted by law, VIS Mountain disclaims liability for losses arising from use of this information.
Straight answers.
Which is the safest of the three?
The question does not have a clean answer, because hosting and access are two different halves of the problem. A managed platform means the vendor patches the host, and you still decide everything the bots can reach, which is where most incidents come from.
A self hosted platform gives you control over data and locality and hands you the operating system, the network exposure, the updates and the backups. Which of those is safer depends entirely on whether somebody at your business will actually do the second set of jobs.
Is OpenClaw unsafe to use?
No, but its marketplace has a documented history that has to shape how you use it. Unit 42 reported five unblocked malicious skills it found and reported between February and May 2026, and relayed Bitdefender Labs estimating approximately 17 percent of the skills it analysed in the platform's first weeks carried malicious payloads, plus Koi Security's disclosure of 341 malicious skills.
The practical reading is that a community package registry needs the same treatment as any other: never run the gateway open to the world, authenticate it, keep tool policy and sandboxing conservative, and treat every third party skill as untrusted code until you have read it.
Can I run more than one of these?
Yes, and there is a sensible pattern for it: a managed platform for front office work such as inbox, reporting, drafts and approvals, and a self hosted agent on your own server for anything that has to touch private systems.
The join between them is the part to design carefully. The managed side should reach the private side only through an authenticated endpoint you control, rather than by being given broad access to your network.
Does choosing a platform change how I should structure the team?
No. Narrow roles, a chief of staff, a reviewer, the approval packet, one brand context, phased least privilege access and the inbox rules apply identically to all three.
What changes is who owns the host and what the agents can physically reach. Those are access decisions rather than structural ones, which is why the rest of this series is written platform agnostic.
How current is this comparison?
The facts were checked against each project's own documentation in September 2026 and the citations were re-read on 18 September 2026. All three projects move quickly, and at least one of them has changed its name once already.
Treat every specific here as a statement about that month. Verify plan details, limits and security posture with each vendor before you buy or deploy, and assume anything involving price has moved.
Do any of these give true isolation between agents?
On Grok Bot, no. xAI's documentation states that all bots on an account share one computer and every login on it, and that separate bots should not be used as a security boundary. Hermes Agent's Bot Mode includes subagents that can run in isolated environments, and OpenClaw supports multiple agent workspaces while being designed around a single personal assistant.
If genuine isolation between agents is a requirement rather than a preference, that is one of the few factors in this comparison that decides the answer on its own.
Where this comes from.
Primary documentation and published research behind the guidance on this page.
- xAI: Grok Bot documentation (opens in a new tab)The vendor's own description of bots, the cloud computer, memory and sessions.
- xAI: Grok Bot for teams and enterprises (opens in a new tab)Admin policies, allowlists, and what isolation the platform provides between members.
- Nous Research: Hermes Agent (opens in a new tab)The project site for the open source, self hosted agent compared in this series.
- OpenClaw documentation (opens in a new tab)The project's own setup and hardening guidance, including its warnings about exposure.
- Palo Alto Networks Unit 42: OpenClaw AI supply chain risk (opens in a new tab)The security analysis behind the marketplace and exposure findings described here.
- NIST: AI Risk Management Framework (opens in a new tab)A published framework for documenting who is responsible for an AI system's risks.
Talk to the team
A short call, a look at how the business currently shows up, and a straight answer on what we would do first.