OpenClaw vs Hermes vs Grok Bot: None Is Safe by Default

OpenClaw's approval prompts are switched off by default on its gateway and node hosts, and Grok Bot's bots share one computer, one browser session and one set of app logins with no security boundary between them. Both facts come from the products' own documentation, checked in August 2026. They matter because the question buyers ask — which of these is safest — has the same answer for all three: none of them, until someone configures it. What separates them is what that configuration costs you and who holds the machine while you do it.

Three products, three answers to the same question, and one thing nobody puts in the marketing: none of them is safe when you install it.

That is not a criticism. It is the nature of software that can read your inbox, open your files and act in your accounts. What separates OpenClaw, Hermes and Grok Bot is not capability — all three will draft your replies and chase your follow-ups competently. It is where the work happens, who holds the machine, and how much you have to do before the thing is fit to point at a real customer.

How do the three compare side-by-side?

The row that settles most cases is the fourth one. Two of these run where you tell them to. One does not.

What is each one, in plain terms?

Each of the three solves a different shape of problem, and the one-line version of each is enough to place it.

OpenClaw is a gateway. It sits between the chat apps you already use — Slack, WhatsApp, Telegram, Signal, Discord, iMessage, Teams, Google Chat — and an AI agent, so you can message the agent the way you message a colleague. Peter Steinberger started it in November 2025 under the name Clawdbot. It is open source, it installs in about five minutes, and it runs on hardware you own. There is a fuller explanation in what OpenClaw is.

Hermes is a resident. Built by Nous Research and released in February 2026, it runs as a persistent process on your own infrastructure rather than waiting to be asked. It remembers across sessions, runs scheduled work without reminders, and — the part that distinguishes it — writes reusable skills from tasks it has completed, then patches those skills when they turn out to be incomplete or wrong. We have covered how that learning works separately.

Grok Bot is a team on someone else's computer. xAI launched it on 11 August 2026. You create named bots, give each one a job, and they work on a persistent cloud computer that xAI operates. They hand tasks to each other, sign into tools through a browser the way a person would, and keep working after you close your laptop.

Grok, or Grok Bot?

Grok and Grok Bot are different things, and the confusion is common enough to be worth thirty seconds.

Grok is a model. It is the thing that does the thinking, and it is interchangeable. OpenClaw needs a model and does not care much which one — Grok, Claude, GPT, or something running locally on your own hardware. If you already pay for Grok, you can point OpenClaw at it.

Grok Bot is a product. It is xAI's own agent system, with its own cloud computer, its own bots and its own interface. It is not a model you plug into anything.

So: using Grok as OpenClaw's model does not give you Grok Bot, and holding a Grok Bot subscription does not give you OpenClaw. They solve different parts of the problem and you can sensibly end up paying for both, or neither.

Where does the work actually happen?

Settle this first, because it eliminates options faster than anything else.

OpenClaw and Hermes both run on hardware you control — a machine in your office, or a server you rent in a country you name. Your messages and files stay on it. The accounts are in your name. Because both are open source, there is no licence anyone can withdraw and no vendor who can change the terms underneath you.

Grok Bot cannot be self-hosted. The bots live on a cloud computer that xAI provides and operates. That is the deliberate design — it is exactly what lets them keep working while your devices are off — but it means the machine, the browser sessions and the terms of service belong to xAI.

For a lot of everyday work that is a perfectly reasonable trade. For work under a confidentiality agreement, or work where you must be able to state which country information is processed in, it is usually the end of the conversation.

What happens when it gets something wrong?

On approvals, the marketing and the documentation part company.

OpenClaw is widely described — including in a comparison we have published ourselves — as the approval-first option. Its own documentation is more precise than that. Commands run when "policy + allowlist + (optional) user approval all agree", and prompting is governed by an ask setting with three values: off never prompts, on-miss prompts only when the allowlist does not match, and always prompts every time.

The default for the gateway and node hosts is security: "full" with ask: "off". In plain terms: as delivered, on the hosts most people actually run, OpenClaw executes commands without stopping to ask. Sandbox hosts default to deny instead, and approvals can only tighten a host's configured security rather than loosen it — but the permissive default is what you get if nobody changes it.

OpenClaw's approval prompts are switched off by default on its gateway and node hosts. The safety people describe as a feature of the product is a configuration decision someone has to make.

That reframes the comparison. OpenClaw is not the safe one and Hermes the reckless one. OpenClaw is the one with the most precise controls available — per-agent allowlists, glob patterns, argument-level restrictions through regular expressions, three-state prompting — and those controls are off until configured. Once configured, prompts offer allow once, allow always, or deny, and if no approval interface is reachable the fallback is to deny.

Hermes takes the opposite posture openly. It is designed to work unattended between check-ins; that is the product, not an oversight. The question is not whether it will act without asking but where you have decided it must stop, and that decision has to be made before it touches real work rather than after.

Grok Bot's documentation is the clearest of the three about what deserves a gate. xAI's guidance is to keep sending, publishing, purchasing, deletion and production changes behind approval. When an action needs sign-off, the conversation shows the proposed operation and its inputs, and on desktop you get allow once or deny. It also hands control back for passwords, two-factor codes and anything else that genuinely needs a person.

So all three can be made to stop and ask. None arrives that way, and only one tells you plainly in its own documentation which actions deserve it.

Can the agents see each other's work?

Whether one agent can reach another's access is rarely asked and occasionally expensive.

If you run several agents — one on the inbox, one preparing quotes, one keeping records straight — you probably assume the one that writes drafts cannot touch the one that handles payments. That assumption holds for two of the three.

OpenClaw scopes access per agent. Allowlists are defined per agent, sessions are isolated per workspace, and routing sends messages to specific agents based on sender or workspace. Hermes runs separate agents and spawns subagents, each with the access you gave it.

Grok Bot does not work that way, and xAI says so directly: the computer is isolated to your account rather than to an individual bot, and bots share files, browser sessions and app logins. Each bot gets its own screen on that shared computer, which lets several work in parallel — but, in xAI's own words, without getting separate security boundaries.

That is a genuine feature. It is what makes hand-offs work without repeating setup: the research bot logs into a tool once and the bot writing the summary is already signed in. It is also a real constraint. A bot you meant to keep away from your banking session is on the same machine as a bot that has one open. If you run Grok Bot, which jobs you group onto one account matters more than it would elsewhere.

Does it get better, or just keep going?

OpenClaw does what it is asked, each time, and accumulates nothing. If you want it to handle something differently you tell it, again.

Hermes learns by doing. After a complex task it writes a reusable skill capturing what worked, and when a skill turns out to be outdated or wrong it patches it during use. Nous Research's internal benchmarks claim agents with twenty or more self-created skills complete comparable tasks around 40% faster than a fresh instance, in both tokens and wall-clock time. Treat that as a vendor figure — it is the maker's own measurement, not an independent one — but the mechanism is documented, and it is why Hermes repays a long relationship.

Grok Bot learns by watching. You record yourself doing a task once, up to ten minutes, and it converts that recording into a routine it can repeat. For a non-technical owner this is often the easiest teaching model of the three: showing is simpler than specifying.

The practical difference is that Hermes gets better at work you have already given it, while Grok Bot is quicker to teach something new.

What does each one cost to run?

The purchase price is the least interesting part of the number. OpenClaw and Hermes are free to obtain, and Grok Bot is included in a subscription you may already hold. What differs is the shape of the cost afterwards.

OpenClaw and Hermes cost you a machine and model usage. If you already have a server, the marginal cost is the model calls. If you do not, a small rented server covers most single-agent setups. Hermes has a specific advantage here: deployed serverlessly it hibernates when idle, so bursty work costs close to nothing between tasks rather than idling at full price. Neither charges per person, so adding colleagues does not add to the bill.

Grok Bot costs whatever the qualifying subscription costs, for each person who needs one. That is genuinely simpler — one line on a card, no server to think about — and it is the model that grows fastest as a team grows.

The rule of thumb: below about three people, renting is simpler and cheaper. Above that, owning stops being the expensive option.

What do you need before you can start?

OpenClaw needs a machine and Node.js. It is open source and free to run; you pay for the hardware and the model usage.

Hermes needs a machine or a rented server, and is likewise open source.

Grok Bot has the hardest prerequisite by some distance. As of August 2026 it is in beta and bundled with SuperGrok Heavy, Cursor Ultra or Cursor Teams Premium. It is not sold separately. Enterprise access is on a waitlist. It runs on macOS, Windows and iOS 18 or newer, with no Linux, Android or iPad version. If you do not already hold one of those subscriptions, this is not a choice you can make this week.

So which one should you pick?

Work down these in order. The first that applies is your answer.

If two of them still fit after that, the difference is control and privacy rather than capability. Either will do the work.

Can you run two of them?

Yes, and plenty of businesses end up there — an approval-gated assistant for anything client-facing, and a resident agent handling the internal coordination behind it.

The mistake is starting both at once. Two implementations running in parallel split the attention of whoever owns them and delay results from either. Get one working on a real workflow, calibrate it until the corrections stop, then add the second. If you want the detail on deploying the first one properly, we have written a setup guide for OpenClaw in a business.

Frequently asked questions

Is Hermes tied to Grok, or can it use other models?

OpenClaw and Hermes both run on your own infrastructure and connect to whichever model provider you point them at, so neither is tied to one vendor. Grok Bot is the exception, because it is xAI's own product running on xAI's computers.

What about Claude Code and the other names people mention?

Most of the other tools in that conversation are aimed at developers writing software, not at owners handing over routine business work. We compare these three because they are the three we set up for non-technical teams.

Do we need a developer on the team to keep this running?

Not to run it day to day. You do need one person inside the business who owns it — who notices when a draft comes back wrong and says so. The technical upkeep is what the setup and support service covers.

If we pick the wrong one, how hard is it to switch?

With OpenClaw or Hermes, the machine and the accounts are already yours, so switching is mostly re-scoping what the agent may touch. With Grok Bot the sessions and the computer belong to xAI, so leaving means setting the logins up again elsewhere.

Notes

1. OpenClaw, Exec approvals. Documents the ask setting values, the security: "full" / ask: "off" default for gateway and node hosts, the sandbox deny default, allowlist glob and argPattern matching, and the allow once / allow always / deny resolutions. https://docs.openclaw.ai/tools/exec-approvals
2. OpenClaw, Documentation overview. Gateway architecture, supported chat channels, installation requirements, allowlists, mention gating and per-workspace session isolation. https://docs.openclaw.ai/
3. Nous Research, Hermes Agent documentation. Self-hosted daemon model, persistent memory with session search, skill creation and in-use patching, 20-plus platform connectivity, deployment targets including local, Docker, SSH and serverless, and the internal 40% skill-reuse benchmark. https://hermes-agent.nousresearch.com/docs/
4. SpaceXAI, Grok Bot — Approvals, security, and privacy. Guidance to keep sending, publishing, purchasing, deletion and production changes behind approval; the approval interface; and the statement that the computer is isolated to the account rather than the bot, with bots sharing files, browser sessions and app logins and no separate security boundaries. https://docs.x.ai/grok-bot/approvals-security-and-privacy
5. SpaceXAI, Introducing Grok Bot, 11 August 2026. Launch date, the persistent cloud computer model, teaching by demonstration, and beta availability through SuperGrok Heavy, Cursor Ultra and Cursor Teams Premium. https://x.ai/news/introducing-grok-bot

Product facts in this article were checked against the vendors' own documentation on 30 August 2026. All three ship changes frequently and Grok Bot is three weeks old at publication — check the source before relying on a specific behaviour.