Nod vs OpenClaw: both are open-source AI agents that run on your own computer or server, where they run commands, operate websites and write messages. The biggest difference is the security model. Nod sends every command into an isolated container, enters passwords itself without the model ever seeing them, and has the server check every action beyond reading and drafting against your request. OpenClaw runs tools directly on the machine unless you set up a sandbox, and by default it trusts the one operator using it. In return, OpenClaw reaches you in more than 20 messaging apps and has a large community, while Nod is a young research preview with an app, Telegram and WhatsApp. Hermes Agent from Nous Research is a third open agent that often gets compared with OpenClaw: free choice of model, many channels, and the project itself names the operating system as the only real security boundary. All vendor details as of November 15, 2026.
I installed the Nod server from source on my Mac on November 15, 2026, version 0.7.6. It is only reachable on 127.0.0.1 and answers 403 without a token. What OpenClaw can do and how to secure it is covered in OpenClaw Alternative for Businesses. Everything about Nod, OpenClaw and Hermes Agent in this article is based on the projects' repositories, docs and security policies, retrieved on November 15, 2026. Everything I have written about AI agents is collected on my AI agents page.
Nod vs OpenClaw in one table
Hermes Agent sits in the third column because it is often compared with OpenClaw.
Stars show how many people follow a project. They say nothing about quality or security. Nod is by far the youngest of the three.
The security model: the biggest difference
All three agents can run commands, write files and send messages. How far they get is handled differently by each.
Nod: rules in the server, commands in a container. n8n puts it this way: "Policy lives in the server, not the prompt." Nod runs commands in its own Linux workspace, which runs as an unprivileged user with no Docker socket, no keys and no browser profiles. It reaches the network only through its own firewall, which blocks private addresses. Nod operates websites in its own browser container. Before any app action beyond reading and drafting, the server checks whether your request covers it; the check has to quote your words, and the server verifies those words really exist. According to the docs, pages, emails and files cannot grant permission. n8n names the limit itself: the check is a model's judgement, and no checker is immune to prompt injection.
OpenClaw: one trusted operator. The security policy describes OpenClaw as infrastructure for trusted operators, not as a boundary between users who distrust each other. Anyone who can operate an agent can make it do anything that agent can do. Tools of the main session run directly on the machine unless you set up a sandbox, and for a single operator, commands run without prompts by default according to the docs. The sandbox with Docker, Podman and other backends is off by default and, per the docs, "not a perfect security boundary". Plugins count as trusted code, and the policy does not treat prompt injection on its own as a vulnerability. On GitHub, OpenClaw published 722 security advisories between January 31 and September 11, 2026, 14 of them rated critical; none were added through November 15, 2026.
Hermes Agent: the operating system as the only boundary. Nous Research writes in its security policy: "The only security boundary against an adversarial LLM is the operating system." The approval gate for dangerous shell commands, secret redaction and skill scanning are useful, the project says, but explicitly heuristics. With the default backend, commands run directly on the machine. If you process content from the open web, inbound email or untrusted MCP servers, the policy says to wrap the whole agent in a container, for example with its own Docker image or with NVIDIA OpenShell. Plugins and skills run with the agent's full privileges.
In short, Nod ships with isolation out of the box; with OpenClaw and Hermes Agent you set it up yourself. With all three, a model ultimately decides whether an action fits the request, and injected instructions are not ruled out. How such attacks work and how to protect an agent against them is covered in Prompt Injection: Protecting AI Agents. What Nod sends to n8n, the model and other services, and how to set up approvals, is in Nod Privacy: What the AI Agent by n8n Shares.
Channels and models
Channels. OpenClaw is built around messaging: you write to it in Discord, iMessage, Slack, Teams, Telegram, WhatsApp or, per the project, more than 20 other services, and there are companion apps for macOS, iOS, Android, Windows and Linux. Unknown senders in direct messages have to pair first by default. Hermes Agent serves Telegram, Discord, Slack, WhatsApp, Signal and email from one gateway, plus a terminal interface. Nod has its app for web and desktop, Telegram and WhatsApp, all in the same conversation. In Nod, sign-ins and payments stay in the app, and per the docs sign-in links never go through Telegram or WhatsApp.
Models. All three leave the choice to you. Nod works, per n8n, with more than 30 providers, a ChatGPT Plus or Pro plan via sign-in, and local models through Ollama, LM Studio, vLLM or llama.cpp. Claude only works in Nod with an API key, because Anthropic's conditions require an API connection according to the docs. In OpenClaw, models and agent runtimes such as Claude, Codex or local models are plugins you swap without changing anything else. Hermes Agent takes any model, per Nous Research, optionally through a Nous Portal subscription that bundles more than 300 models and tools such as web search and a cloud browser.
With all three, the choice of model is also a security question. In 240 test decisions by n8n, GPT-6.1 Sol and Claude Opus 5.5 got every one right, while Claude Haiku 5.5 let 8 unsafe actions through. OpenClaw's docs call command approvals a guardrail for operator intent, not isolation, and in its default "smart" mode Hermes Agent has a helper model assess the risk.
Setup and operation
Nod is quickest to start with the desktop app, which needs neither Node.js nor Docker. Schedules only run while the computer running Nod is on; for always-on use, Nod belongs on your own server or a Mac mini. According to the docs, one server belongs to one person, and there is no multi-user setup. Installation is covered in Install Nod: Set Up the AI Agent by n8n, and the server route with Docker Compose in Nod Self-Hosted: AI Agent by n8n on Mac mini.
OpenClaw installs with a script that brings Node.js along when needed, or through npm from Node.js 24.16. A wizard then checks model access, creates the workspace and configures the Gateway. Per the README, a Gateway can be a personal agent on a laptop or a shared one for several people. The security policy still recommends one user per machine or VPS; per the docs, everyone who can message an agent shares its permissions. A hardened setup step by step is in OpenClaw Alternative for Businesses.
Hermes Agent also installs with a script, on Windows even without WSL, and you set it up with hermes setup. Schedules run on a built-in cron scheduler. On Daytona or Modal, the environment hibernates when idle and wakes on demand, per Nous Research. If you are coming from OpenClaw, Hermes imports persona, memory, skills, command allowlists and messaging settings according to the README, and API keys only when you explicitly ask.
Hermes Agent as a third option
Hermes Agent promotes a built-in learning loop: it creates its own skills from experience, improves them while using them, searches past conversations and builds a picture of you across sessions. It runs subagents in parallel, can write Python scripts that call tools, and has more than 40 tools per the README. Nod also learns procedures as skills and remembers facts about you. According to the docs, the facts come only from your own messages, never from pages or emails it reads. Skills, on the other hand, Nod writes from what it did and read, so a page or email can shape a skill that steers later tasks. A skill never grants permission.
Compared with OpenClaw, Hermes Agent leans more towards the terminal and servers, with six execution environments from local to cloud sandbox. Both assume a single, trusted operator and leave isolation in your hands.
Which one fits when
For fixed workflows, n8n Workflow Tutorial: Build, Test, Export shows how to build one, and when to pick a workflow and when an agent is covered in n8n, Make, or Claude: What For?. The big comparison of Nod with Claude Cowork, ChatGPT Dots and Grok Bot is in Claude Cowork Alternative: Nod Compared. How Nod compares with a self-built AI server running Claude Code and Slack is in Nod vs Claude Code: AI Agents Compared. What agents with their own computer and browser can do in general is explained in Computer Use Agent: AI That Clicks for You.
Frequently asked questions
What is the difference between Nod and OpenClaw?
Both are open AI agents for your own machine. Nod comes from n8n, always runs commands in an isolated container and checks actions in the server before they run. OpenClaw comes from the OpenClaw Foundation, runs directly on the machine unless you set up a sandbox, and reaches you in far more messaging apps.
Is Nod more secure than OpenClaw?
By default, Nod is more tightly isolated: commands run in a container, the model never sees passwords, and actions are checked in the server. You can secure OpenClaw to a similar level with a sandbox, restricted tools and a separate environment, but you have to do it yourself. With both, a model decides on actions, and Nod is a research preview.
What is the difference between OpenClaw and Hermes Agent?
Both are open agents under the MIT license with free choice of model and messaging integrations. Hermes Agent leans more on the terminal, servers and cloud sandboxes and creates its own skills from experience. OpenClaw has more channels and companion apps for phone and desktop. Hermes can import settings, memory and skills from OpenClaw.
What do Nod, OpenClaw and Hermes Agent cost?
The software itself is free for all three. Costs come from the model provider and the computer or server. Nod also works with a ChatGPT Plus or Pro plan and with local models at no cost per request; Hermes Agent optionally with a Nous Portal subscription. What Nod costs with which model is in Nod Pricing: What the AI Agent by n8n Costs.
Can I use Claude with Nod, OpenClaw or Hermes Agent?
With Nod, only with an Anthropic API key. OpenClaw lists Claude as a swappable model plugin. Hermes Agent supports Anthropic as a provider and, according to its docs, by default reads and refreshes the Claude Code credentials on the same machine when it has no login of its own, which can invalidate your Claude Code login. According to Anthropic's own docs, third parties may not collect Claude credentials or route requests through Free, Pro, Max or Ultra plan credentials. For Claude in a third-party agent, use an API key and turn off adopt_external_logins in Hermes.
Which agent fits a business?
None of the three cleanly separates several users from each other. For one person who hands off their own tasks and wants to keep approvals, Nod is the most cautious start. More important than the tool is that permissions, isolation and approvals are set technically before real customer data flows.
How to continue
First decide what the agent may do: which accounts, which data, and what it must never do without you. Then pick the agent that comes with that boundary, or one where you can draw it yourself. Test it on a separate computer or in a VM with test data before you connect real inboxes. How I build AI employees with clear permissions and approvals is something I show in my community Claude Practitioners.
