Is OpenClaw Safe? OpenClaw and Hermes Agent Security, Settings to Change

OpenClaw is safe enough to run if you treat it like what it is: a program that can read your messages and email, run commands and act on what it reads. Out of the box it leans toward capability. Commands run on your host because sandboxing is off by default, and it checks in with the project’s server daily. Both are fixable in a few minutes. The same is true of Hermes Agent, with different defaults.

What can actually go wrong

• Commands on your host. Without a sandbox, a bad command runs with your user’s access to your files.
• Prompt injection. Anything the agent reads, an email, a web page, a shared document, can carry instructions aimed at it. The more accounts it can act on, the more an injected instruction can do.
• Third-party skills. Skills are code you install. In January 2026 Cisco’s AI security team reported a third-party OpenClaw skill that exfiltrated data and ran prompt injection without the user knowing (summary on Wikipedia).
• An exposed gateway. If the control interface is reachable from the internet without auth, anyone can drive your agent.
• Secrets at rest. The same Wikipedia article summarizes an August 2026 review of OpenClaw 2.0 that criticized secrets stored unencrypted at rest.

Defaults across ten agents

The checklist table above shows which agents sandbox by default and which send telemetry. Here’s what that means in practice and how to change it.

Agent	Isolation out of the box	Telemetry and how to turn it off
OpenClaw	Off; Docker sandbox available	Daily update check; update.checkOnStart: false
Hermes Agent	Off; smart approvals, Docker backend available	None unless you opt in
NemoClaw	On: OpenShell sandbox with egress approval	CLI telemetry; NEMOCLAW_DISABLE_TELEMETRY=1
NanoClaw	On: one container per agent	Setup diagnostics; NANOCLAW_NO_DIAGNOSTICS=1
ZeroClaw	On: OS sandbox and approvals in the Balanced profile	None
Rakazo	On: each bot has a sandboxed computer	None from a self-hosted server; the desktop app checks for updates
Agent Zero	On: agent works in its own Docker container	Update check; turn off in settings
nanobot	Off; bubblewrap or Seatbelt available, none on Windows	None
PicoClaw	Path checks only; process isolation off, Linux and Windows only	None
QwenPaw	Off; no isolation inside Docker	Install data with --defaults; decline it in interactive qwenpaw init

Two caveats on the “on” rows. Agent Zero runs code in the same container as Agent Zero itself, so the container protects your computer but not the agent from its own code. And ZeroClaw’s YOLO profile switches everything off, so check which profile you picked.

How to lock down OpenClaw

In rough order of impact, using OpenClaw’s security docs:

1. Run openclaw security audit. It reports where your setup has drifted from the safe defaults, and can apply supported fixes.
2. Keep the gateway on loopback. A normal install binds to loopback, but container images default to an exposed bind, so add auth or put it behind a private network before deploying with Docker.
3. Keep DM pairing on. By default, unknown senders on most channels get a pairing code instead of a reply. Don’t switch a channel to open.
4. Turn on the sandbox. Set agents.defaults.sandbox.mode to all; non-main leaves the agent’s main session on the host (sandbox modes). Docker is the default backend. Only tool execution is sandboxed: the gateway stays on the host.
5. Deny what you don’t need. A tool policy deny on exec disables shell access entirely. Avoid tools.elevated, which runs commands outside the sandbox.
6. Use separate accounts. The docs recommend separate numbers for WhatsApp, Signal and Telegram, and one gateway per trust boundary: don’t share one gateway between people who don’t trust each other.
7. Read skills before installing them, and prefer official plugins.
8. Set update.checkOnStart: false if you don’t want the daily check-in (telemetry docs).

If you want all of this enforced from outside the agent, run OpenClaw inside NemoClaw, which adds a sandbox, egress approval and credential custody.

Is Hermes Agent safe?

Hermes Agent starts in a better place on privacy (no telemetry) and on chat access: with no allowlist set, it denies every user, and unknown DMs get a pairing flow (security docs). Its weak spot is the same as OpenClaw’s: the terminal backend defaults to local.

To lock it down:

• Set terminal.backend: docker. Containers drop all but a few Linux capabilities, and host secrets stay out unless you list them in docker_forward_env, so keep it empty.
• Keep approvals on. The default smart mode lets a helper model judge risk; manual asks before every dangerous command. Never use off, which equals --yolo.
• Set allowlists such as TELEGRAM_ALLOWED_USERS and never GATEWAY_ALLOW_ALL_USERS=true.
• Run chmod 600 ~/.hermes/.env, and set auth.adopt_external_logins: false if you don’t want Hermes using your Codex CLI or Claude Code logins.

Rules that apply to any agent

• Give it its own machine or OS user. A spare computer or small server limits the blast radius in a way no setting can.
• Scope credentials. Connect a separate email or calendar account where you can, and use API keys with spending limits.
• Allowlist who can talk to it on every channel.
• Review scheduled jobs. An agent that works while you’re away also makes mistakes while you’re away.

If safety is your top priority

Pick an agent that isolates by default rather than one you have to harden: ZeroClaw or NanoClaw for a single personal agent, or NemoClaw if you want OpenClaw or Hermes Agent specifically. Our self-hosted ranking weighs safe defaults heavily, and what OpenClaw is covers the rest of the trade-offs.