OpenClaw alternatives compared: Hermes, ZeroClaw, OpenFang, IronClaw, NanoClaw, PicoClaw, and Agent Zero

Feature lists make these eight runtimes look interchangeable. They are not, and the differences that matter show up in defaults rather than feature counts: what runs where, what the agent is allowed to remember, and whether it acts while someone is watching. This comparison is based on official READMEs, documentation, and release pages checked on 2026-11-04. Nobody here installed all eight and ran a shared workload, so it says nothing about task quality or speed. Versions cited: OpenClaw v2026.10.10, Hermes Agent v0.22.7, ZeroClaw v0.8.7, Agent Zero v2.15, IronClaw v1.4.1, NanoClaw v2026.10.0, PicoClaw v0.3.1, OpenFang v0.6.9.

The dimensions a buyer can separate these on are reach, what persists between sessions, whether work runs unattended, how a generated command is confined, what hardware it needs, and whether the project is shipping. The sections below take them in that order of consequence: confinement first, because it bounds the damage every other dimension can do.

How a generated command is confined

OpenClaw reaches more than twenty channels and ships companion apps for five operating systems, with models and agent harnesses as swappable plugins. Its security guide states that main-session tools run on the host unless sandboxing is configured. Most installations will keep that default, so the deployed reality is a widely reachable agent executing commands as its owner. OpenClaw pairs unknown senders before it will talk to them. Pairing verifies who sent a message. A known contact can still paste a poisoned document into the chat, and pairing says nothing about that.

ZeroClaw's sandbox documentation offers Landlock, Firejail, Bubblewrap, Seatbelt, and Docker wrappers. Under auto selection on the native runtime, a stock build tries Firejail on Linux and Seatbelt on macOS, and lands on no sandbox when neither is available. Naming a backend explicitly does not fall through to the next option either. The supervised autonomy policy still gates medium- and high-risk operations, but a permission prompt only helps when someone is present to answer it. Anyone deploying ZeroClaw should pin the backend and check the startup log for what was actually selected.

Hermes Agent offers the widest backend menu of the group: local, Docker, SSH, Modal, Daytona, Vercel Sandbox, and Singularity by plugin. Its local backend has no OS isolation, so the boundary depends on a choice made at install time. The serverless backends hibernate between sessions, which makes an always-available agent cheaper to keep than an always-running machine. PicoClaw has workspace rules and command deny patterns rather than an OS boundary. Its README warns about unresolved security issues before v1.0 and advises a VM or container for hostile code. The practical difference from ZeroClaw is that PicoClaw's weaker control is the only control it claims, so a deployment gets what the documentation describes.

Memory and skills

Hermes builds its product around a learning loop: curated memory, skills written after complex tasks and revised during use, full-text session search, and user modeling through Honcho. For repeated research or reporting work, accumulated procedure is worth real time. It is also persistent. An injection that would waste one session in a stateless agent can instead be written into a skill or a memory entry and shape sessions after it, until someone reads the learned artifacts and removes it. Hermes deployments should treat that directory as code under review, with diffs a person can read and a way to revert. On the local backend, those self-written instructions govern an unbounded process, which is the riskiest pairing in this comparison. On a container or serverless backend, the same loop is much easier to justify.

The other projects remember more conservatively. IronClaw keeps a persistent workspace with hybrid text and vector search. NanoClaw keeps memory per agent group, inside that group's container. Agent Zero persists a full workspace across sessions. None of them writes and revises its own procedures the way Hermes does, which makes them duller over time and easier to reason about after an incident.

Where confinement ends

IronClaw runs untrusted tools in WebAssembly with capabilities granted per tool, HTTP limited to allowlisted endpoints, and secrets injected at the host boundary so tools never hold them. OpenFang gives its WASM tools a fuel budget, a 16 MB memory limit, and a timeout. Both confine what a compromised tool can do. Neither addresses an agent persuaded to use a permitted tool for an unwanted purpose, since every check in that path passes. The agent process, holding the conversation and the credentials, sits outside the WASM boundary in both designs. A container runtime confines that process instead, at the cost of coarser control over individual tools.

NanoClaw's unit of isolation is the agent group, with one Linux container per group and only mounted directories visible inside it. That matches how trust already works in messaging: a family chat, a work channel, and a public community should not share a filesystem, and per-message filtering is a weaker way to get there. Credentials stay outside the container and pass through a gateway with per-agent policy. NanoClaw's October release-candidate notes required a gateway update to close a credential-injection bypass, so the guarantee has failed in a shipped build before and was fixed in a later release.

Agent Zero runs a Dockerized Linux desktop with a browser and XFCE, persistent across sessions. It can operate software that has no API, and nothing else here can. Its optional host connector crosses the container boundary by name and by design; turning it on should get the review that opening remote access to a workstation would get.

Unattended work and project health

OpenFang packages recurring work best. A Hand bundles a tool manifest, requirements, a long system prompt, a skill file, and guardrails, then runs on a schedule and reports to a dashboard. Seven Hands ship in the binary. The job, its tools, and its approval gates can all be reviewed before anything runs, which a chat session with a cron entry attached does not offer. The problem is the calendar. OpenFang v0.6.9 shipped on 2026-05-12 and no release has followed, on a project that flags itself pre-1.0 and advises pinning a commit for production. A chat agent nobody maintains stops improving. A scheduled one keeps spending and keeps acting.

Comparable scheduling exists on maintained projects, with less packaging. IronClaw routines fire on cron, events, and webhooks. ZeroClaw's SOP engine triggers from MQTT, webhooks, cron, and hardware peripherals, with resumable runs. Hermes runs cron jobs and delivers output to its channels. For any of them, the question worth asking a finalist is what happens when an approval gate times out with nobody awake. Expiry into execution makes the gate decorative. Expiry into a queue makes it a control. The documentation rarely answers this, and it matters more than the trigger list.

Release cadence itself is worth weighing for software in this category, because integrations and model behavior shift under it. OpenClaw, Hermes, and Agent Zero all shipped in the first three days of November. PicoClaw last shipped in July and OpenFang in May. A buyer is choosing a maintainer as much as a runtime.

Hardware and upkeep

On a server, all eight are minor costs next to the model bill, and hardware only separates them at the edges. PicoClaw runs on cheap RISC-V boards and router-class devices that the Node and Python runtimes cannot use. Its README claims under 10 MB of RAM and notes that recent builds may use 10 to 20 MB, so the figure to check is peak memory on the target board rather than anything on a release page. ZeroClaw's single Rust binary, with GPIO and peripheral support, targets the same small-machine end. At the other end, Agent Zero needs a Docker host with room for a desktop environment, and NanoClaw requires Docker for its containers.

Upkeep separates them more than hardware does. NanoClaw expects the operator to maintain a fork and add channels to it, which trades OpenClaw's plugin breadth for a codebase one team can read in full. That trade pays only for teams that will read it. Hermes shifts upkeep inward: the skills and memory it accumulates need review as they grow. OpenClaw, Hermes, and Agent Zero shipped in the first three days of November, so their integrations are being patched against current model and platform behavior. PicoClaw last shipped in July and OpenFang in May, and a buyer of either is accepting a slower maintenance cadence from the start.

Choosing between them

OpenClaw is the choice when the agent has to meet people where they already are, provided sandboxing is configured before other people's accounts are connected. Hermes is the choice when the work repeats and accumulated procedure has value, on an isolated backend, with learned artifacts reviewed. IronClaw fits operators whose worry is hostile or sloppy tools rather than hostile prompts. NanoClaw fits teams whose chats carry different levels of trust, and who accept maintaining a fork. Agent Zero fits work that needs a desktop. PicoClaw fits constrained hardware, inside an outer boundary, accepting pre-1.0 status. ZeroClaw fits a small-service deployment only with its sandbox backend pinned and verified in the log. OpenFang's Hand design is worth copying, and until releases resume that is the part of OpenFang a new deployment can use.

Two tests would change these rankings. The first is ordinary: the same snapshot, model, recurring task, and channel on two finalists, run interactively and from the scheduler, comparing output, memory, files changed, outbound destinations, and credentials shown to tools. The second is to break the deployment on purpose, removing the container runtime, misstating the sandbox mode, and taking an allowed endpoint offline, and record whether each system stops or continues with weaker isolation. Documentation can describe a boundary. It cannot say which side of that line a failed deployment lands on.