AI agents in operations: Hermes, OpenClaw, Grok Bot and Claude compared (as of October 2026)

Summary

AI agents carry out multi-step tasks in your tools, and a multi-agent system splits such tasks across several specialised agents. You usually run Hermes Agent and OpenClaw on your own infrastructure, while Grok Bot and Claude Cowork run on the vendor's computers. That decides where your data sits and who looks after security. Value comes where a task is clearly defined, has exceptions and a human approves at fixed points. If you hand out agents widely without settled permissions, skills and a knowledge base, you buy yourself new attack surface and costs with nothing to show for them.

Note: This article is expressly not legal advice. It describes what the legal texts say, as of 26 October 2026. Whether and how an obligation applies to your organisation is something to clarify with a lawyer.

More than 40 percent will be cancelled

In June 2025, Gartner predicted that over 40 percent of agentic AI projects will be cancelled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls [81]. That is a forecast by an analyst firm, not a measurement.

In its 2026 Hype Cycle for AI, Gartner repeats the 40 percent forecast and writes that only 17 percent of organisations have deployed AI agents today [85]. Gartner does not say on the page how this figure was collected. Treat it as a rough guide, not as a statistic.

Our reading: the problem is rarely the tool. It is handing it out without a task. That is what we mean by the watering can.

Agent, automation or assistant: the task first, then the tool

Before you choose between Hermes, OpenClaw, Grok Bot or Claude, ask a simpler question: does the task need an agent at all? Gartner writes that many use cases positioned as agentic today don't require agentic implementations [81]. Its advice: agents when decisions are needed, automation for routine workflows, assistants for simple retrieval [81]. Fraunhofer FIT takes a similar view in June 2026: for simple tasks, a script, an API integration or classic automation is usually cheaper and easier to run [82].

For your day-to-day work, as our own assessment: if the task runs the same way every time, a fixed workflow is enough. If you only want answers from existing documents, an assistant is enough. An agent pays off only when decisions have to be made along the way because data is missing or contradictory. Matching incoming invoices against purchase orders becomes a case for an agent as soon as amounts differ or line items are missing.

What an AI agent is in principle is covered in AI Agents for SMEs: Hype or Real Opportunity?.

From a single agent to a multi-agent system

According to Fraunhofer FIT, a multi-agent system consists of several specialised AI agents that work together [82]. In everyday language this is often called an agent team: one researches, one writes, one checks. That does not automatically mean better results. Fraunhofer FIT says multi-agent systems are not an end in themselves, and for strongly sequential tasks the extra coordination can even make performance worse [82].

The four systems handle collaboration differently. Hermes Agent works with isolated subagents [17]. OpenClaw can run several isolated agents, each with its own workspace [28]. With Grok Bot, bots run in parallel, message each other and share context in group chats [37]. Claude coordinates subagents in Cowork [50], and Managed Agents offers workflows with many agents as a beta [47].

Every additional agent adds attack surface. The German Federal Office for Information Security (BSI) warns of chain reactions: when several AI agents work together, an attack on one agent can affect other systems [88]. Bitkom lists the overloading of human oversight as a risk of its own [84].

How separately the agents work is not always clear. For Grok Bot, the documentation says all bots of an account use the same cloud computer, and sessions and credentials are shared [37][38][39]. The enterprise announcement of 3 September 2026, by contrast, says each bot runs on its own computer [36]. Until that is resolved, plan as if any bot can see what another one stores.

Four systems compared (as of October 2026)

The table only shows what the vendors themselves document. Where we found no primary source, it says "no vendor information". That does not mean the feature does not exist. Checked on 26 October 2026.

Criterion	Hermes Agent	OpenClaw	Grok Bot	Claude (Cowork, Managed Agents)
Licence, operation	MIT licence, free of charge [17][18]; five execution backends: local, Docker, SSH, Singularity, Modal [17]	MIT licence with no enterprise edition [24]; the gateway runs on your own machine [29]	Vendor terms of service (Grok Bot Terms) [44]; runs only on Cursor-hosted cloud computers, not on premises [41]; beta since 11 August 2026 [33]	Claude Code: all rights reserved [49]; agentic work in cloud sessions, each with its own virtual machine [45]
Data storage	Settings in ~/.hermes/, secrets in ~/.hermes/.env [22]; memory in ~/.hermes/memories/ [20]; two optional external memory plugins [21]	no vendor information beyond the gateway location [29]	Computers currently run in the United States; no per-organisation retention policy [41]	encrypted snapshot of the VM, sandbox expires after 30 days [46]; according to the vendor, data is not used for training by default [45]; ZDR, HIPAA and CMEK not yet available [46]
Tool access	Subagents with their own terminals and Python scripts [17]	Browser control via CLI [29]	Browser, command line, files and connected tools [38]	Claude Code reads code, edits files, runs commands [51]; browser actions in Cowork [50]
Skills, memory	Skills following the agentskills.io standard [19]; memory as files [20]	ClawHub registry for skills and plugins [27]; Active Memory for conversation history [30]	Walk through a path once and save it as a skill [37]; memory from preferences, role and summaries [37]	Skills with risk levels [48]; memory shared with chat [50]
Multiple agents	isolated subagents [17]	several isolated agents, coordinated team [28]	Bots run in parallel and message each other [37]; shared computer according to the documentation [37][38], own computer per bot according to the announcement [36]	Subagents in Cowork [50]; workflows in Managed Agents as a beta since 9 October 2026 [47]
Approvals, security	Approval before common destructive shell commands [23]; the only security boundary is the operating system [23]; by default the agent creates skills without approval [19]	Sandboxing and exec approvals off by default [24]; third-party skills are code you choose to trust [32]; audits are no guarantee [31]	Allow once, always allow or deny [40]; approval requests from routines, triggers or other bots expire after about 10 minutes [40]; sessions and credentials shared between bots [38][39]; without a network policy all network access is allowed [41]; network controls, audit logs, MCP allowlist, OpenTelemetry and SCIM only in Enterprise [41]	Manual mode asks before most actions, auto mode with a reviewing model, the default in current versions depending on how you start [52]; network access off by default for Enterprise [45]; scripts in skills rated high risk [48]
Cost	Software free; model providers and optional hosted services cost extra, paid tiers include monthly credits [17]	no paid tier, no hosted service [24]	included in Premium (30 US dollars a month), Super (100 US dollars) and Ultra (200 US dollars), teams from 30 US dollars per person [44]; not in Plus and Free [43][80]; weekly allowance, then prepaid credit [43]	Pro 20 US dollars billed monthly; Enterprise 20 US dollars per seat and month billed annually, at least 20 seats, usage extra [53]

Microsoft, OpenAI and Google also offer agent platforms of their own [64][59][73]. On OpenAI's Frontier platform, each AI coworker has its own identity with explicit permissions; according to the announcement of 5 February 2026, it was initially available only to a limited set of customers, with broader availability announced for the following months [63].

Three use cases in day-to-day operations

The three examples are deliberately generic. They show a pattern, not measured results.

Incoming invoices from the mailbox. An agent reads invoice emails, matches them against purchase orders and creates a booking proposal. It may read the mailbox and only create drafts in the accounting system. Approving and paying stays with you. You can tell whether it works by how many proposals you accept without changes. The risk: a prepared PDF with a hidden instruction. More on that below.

Triage in a service or project mailbox. An agent sorts incoming requests and drafts replies from approved documents. It may not send. The measure is the share of drafts that go out without correction. The risk is outdated documents: the agent answers only as well as the knowledge base is maintained.

Weekly project status from several tools. An agent team fits here: one collects data from the project tool and calendar, one writes the report, one looks for contradictions. If the data always comes from the same fields, though, a simple workflow with a template is enough. The team pays off only when sources contradict each other and someone has to weigh them.

What goes wrong if you just install it and start

An agent with access to email, files and the internet is not a new office program but a new attack surface. The BSI describes the dangerous combination: AI agents with access to confidential data that process external content from emails or the internet and communicate with external systems [88]. That is exactly the invoice agent: an email with a hidden instruction to change a supplier's bank details lands straight in its work order.

You cannot fully prevent this at present. Even for document-based LLM chats, the BSI writes in its baseline protection of 14 September 2026 that indirect prompt injections are still considered a problem that cannot be conclusively solved; the recommended baseline measures are guidance, not sufficient protection [89]. The OWASP Top 10 for Agentic Applications 2026 list, among others, the misuse of legitimate tools (ASI02) and memory and context poisoning (ASI06) [92]. The principle behind them is Least Agency: no autonomy where it is not needed [92].

Then there is the supply chain. Between February and May 2026, Unit 42 found malicious skills on ClawHub that evaded the scans [98]. According to Unit 42, installing a skill means complete control over the agent's identity, because skill logic and agent authority are not separated [98].

Exposed instances are an issue too. On 31 January 2026, Censys counted 21,639 publicly reachable OpenClaw instances, though most of them still required a token for access [101]. CVE-2026-25253 shows how sensitive a leaked token is: according to the NVD, OpenClaw versions before 2026.1.29 took a gatewayUrl value from the query string and automatically opened a WebSocket connection without prompting, sending a token value [100].

Every camp has vulnerabilities. For Claude Code, for example, CVE-2026-25722 has been published, affecting versions before 2.0.57 [111]. The NVD entry for CVE-2026-114463 in Hermes Agent names no fixed version but links to a pull request and a release of the project [121]. For Grok Bot and the former ChatGPT Agent [62], we found no public advisory in the NVD or on the vendors' pages as of 26 October 2026. This says nothing about their security.

More in our articles on OpenClaw's security risks and shadow AI in companies.

Basic configuration: what has to be in place before the first task

The most important decisions are made before the first prompt. The agent gets its own account, not your admin access. It gets only the permissions it needs for exactly this task, which is also what the BSI recommends [88]. Sending, paying, deleting and publishing need an approval. Network access is limited, logs are kept, and there is a budget cap.

How much the systems help you with this varies a lot. In OpenClaw, sandboxing and exec approvals are off by default [24]. Hermes Agent asks before common destructive shell commands, but the only real security boundary is the operating system [23]. Claude Enterprise runs each session in its own VM with network access off by default [45]. Grok Bot lets you allow an action once, always allow it or deny it; approvals from work that started without you, such as a routine, expire after about ten minutes [40]. Without a network policy of its own, Grok Bot allows all network access; network controls and audit logs are Enterprise only [41]. Cursor chooses the model, and a team model allowlist does not apply to Grok Bot [41].

Data location is part of the basic configuration too. Grok Bot computers currently run in the United States, and requests from the apps go to Cursor's servers [41]. The new unified Claude experience is not yet available for organisations using zero data retention or customer-managed encryption keys (CMEK) [46]. What this means for your obligations under the GDPR is something to clarify with your data protection adviser; this note is expressly not legal advice.

An example: a triage agent with an admin account can read, delete and forward every email. With read access to one mailbox and write access only to a drafts folder, an injected instruction can do far less damage.

Skills: working instructions the agent loads when needed

According to the open specification, a skill is a directory containing at least a SKILL.md file [109]: a described way of working, often with scripts. On 22 October 2026, Anthropic donated Agent Skills to the Agentic AI Foundation of the Linux Foundation [103][104], which also hosts the Model Context Protocol [105]. Hermes loads skills only when needed to save tokens [19].

Skills make an agent more reliable, but they are code from someone else. Anthropic warns that a malicious skill can direct Claude to use tools in ways that don't match the skill's stated purpose [108], and rates scripts in skills as high risk [48]. OpenClaw advises treating third-party skills as code you are choosing to trust [32]. In Hermes, the agent creates its own skills without approval by default [19].

A good first skill is small: "check incoming invoice", with the checking steps, a pointer to the chart of accounts and the rule that nothing is booked without approval. Our conclusion: writing your own skills is often safer than installing other people's. Review third-party skills the way you review software.

Knowledge: keeping memory, skills and RAG apart

Three things get mixed up all the time. Memory is short, persistent facts; in Hermes they are files in ~/.hermes/memories/ and are loaded at the start of every session [20]. Skills are procedures. RAG, retrieval-augmented generation, is retrieval from document collections at run time.

All three can be poisoned. OWASP describes how attackers seed memory and context with malicious data so that later decisions and tool calls go wrong [92]. Even without an attacker, neglect is enough: the service agent quotes last year's price list because nobody maintains the document collection.

Three rules help. The knowledge base inherits the permissions of the source documents. Every collection has someone who keeps it current. And every answer names its source so you can check it.

Why the watering can costs more than a pilot

AI has arrived in German companies, but to different degrees. According to Destatis, a little more than a quarter of companies (26 percent) used AI in 2025 [124]; Eurostat puts the EU figure at 20.0 percent of enterprises with 10 or more employees [127]. Companies that had considered AI but not used it most often named a lack of knowledge (72 percent) and unclear legal consequences (62 percent) [124].

Agents are scaling mainly at large organisations: in McKinsey's 2026 survey, 40 percent of respondents from organisations with annual revenue above 1 billion US dollars report scaling AI agents, compared with 22 percent at smaller ones [130]. About 20 percent say operating costs, including token costs, have limited their use of AI [130]. Respondents were individuals, not companies [130].

Then there is training. In the version amended by Regulation (EU) 2026/1744, Article 4 of the AI Act requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf [2][7]. The second sentence makes clear: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." [7] What that looks like for your organisation is something to clarify with your legal adviser; this section is expressly not legal advice. Why literacy should grow by role rather than by watering can is covered in No AI Team? Why AI Literacy for Everyone Is Better, and the deadlines in EU AI Act after the 2026 amendment.

Checklist: before your first agent

1. The task fits in one sentence and has one responsible person.
2. Agent, automation or assistant has been decided, with a reason.
3. The agent has its own account, minimal permissions and a list of the systems it accesses.
4. Approval points are set: sending, paying, deleting, publishing.
5. You know which external content the agent reads and have assessed the risk of prompt injection.
6. For every skill, origin and version are recorded, and someone has read the code.
7. The knowledge base has a responsible person, an update schedule and the same permissions as its sources.
8. Logs are kept, and it is clear who reads them.
9. Budget cap and abort criterion are set before the pilot starts.
10. The people involved are trained and know what the agent may and may not do.

To assess shadow AI and work through a responsible AI checklist, you can use our AI governance tool.

This article was written with the support of a Grok Bot agent. We checked all four systems, Grok Bot included, against the same criteria and the same sourcing rules.

Sources

2. European Parliament and Council; published by the Publications Office of the EU: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24.7.2026, accessed on 25.10.2026
7. Publications Office of the EU (EUR-Lex): Regulation (EU) 2024/1689, consolidated version (as of 27.07.2026), CELEX 02024R1689-20260727, accessed on 25.10.2026
17. Nous Research: Hermes Agent, product page, accessed on 26.10.2026
18. Nous Research: Hermes Agent, LICENSE, accessed on 26.10.2026
19. Nous Research: Hermes Agent Docs, Skills, accessed on 26.10.2026
20. Nous Research: Hermes Agent Docs, Memory, accessed on 26.10.2026
21. Nous Research: Hermes Agent Docs, Memory Providers, accessed on 26.10.2026
22. Nous Research: Hermes Agent Docs, Configuration, accessed on 26.10.2026
23. Nous Research: Hermes Agent, SECURITY.md, accessed on 26.10.2026
24. OpenClaw Foundation: OpenClaw Docs, Why OpenClaw, accessed on 26.10.2026
27. OpenClaw Foundation: OpenClaw Docs, ClawHub, accessed on 26.10.2026
28. OpenClaw Foundation: OpenClaw Docs, CLI agents, accessed on 26.10.2026
29. OpenClaw Foundation: OpenClaw Docs, llms.txt Index, accessed on 26.10.2026
30. OpenClaw Foundation: OpenClaw Docs, Active Memory, accessed on 26.10.2026
31. OpenClaw Foundation: OpenClaw Docs, ClawHub security audits, accessed on 26.10.2026
32. OpenClaw Foundation: OpenClaw Docs, FAQ Security, accessed on 26.10.2026
33. SpaceXSI (footer: SpaceXAI LLC): Introducing Grok Bot, accessed on 26.10.2026
36. SpaceXSI (footer: SpaceXAI LLC): Grok Bot for Enterprise, accessed on 26.10.2026
37. SpaceXSI / Cursor (docs on docs.x.ai): Grok Bot Docs, Overview, accessed on 26.10.2026
38. SpaceXSI / Cursor: Grok Bot Docs, Computer and apps, accessed on 26.10.2026
39. SpaceXSI / Cursor: Grok Bot Docs, Bots, accessed on 26.10.2026
40. SpaceXSI / Cursor: Grok Bot Docs, Approvals, security and privacy, accessed on 26.10.2026
41. SpaceXSI / Cursor: Grok Bot Docs, Security, accessed on 26.10.2026
43. Cursor (Anysphere): Cursor Help, Grok Bot plans, accessed on 26.10.2026
44. Cursor (Anysphere): Cursor Pricing, accessed on 26.10.2026
45. Anthropic: Unified Claude for Enterprise, accessed on 26.10.2026
46. Anthropic: Claude Help Center, unified Claude experience (Enterprise), accessed on 26.10.2026
47. Anthropic: Claude Platform Release Notes, accessed on 26.10.2026
48. Anthropic: Agent Skills for enterprise, accessed on 26.10.2026
49. Anthropic: Claude Code, LICENSE.md, accessed on 26.10.2026
50. Anthropic: Get started with Claude Cowork, accessed on 26.10.2026
51. Anthropic: Claude Code overview, accessed on 26.10.2026
52. Anthropic: Claude Code permission modes, accessed on 26.10.2026
53. Anthropic: Claude Pricing, accessed on 26.10.2026
59. OpenAI: Codex subagents, accessed on 26.10.2026
62. OpenAI: ChatGPT agent (Hilfeartikel), accessed on 26.10.2026
63. OpenAI: Introducing OpenAI Frontier, accessed on 26.10.2026
64. Microsoft: What is Copilot Studio, accessed on 26.10.2026
73. Google: Gemini Enterprise overview, accessed on 26.10.2026
80. SpaceXSI / Cursor (docs on docs.x.ai): Grok Bot on The X Subscription, accessed on 26.10.2026
81. Gartner, Inc.: Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, accessed on 26.10.2026
82. Fraunhofer FIT, Generative AI Lab: Wann ist ein Multi-Agenten-System eine gute Wahl? (When is a multi-agent system a good choice?), German only, accessed on 26.10.2026
84. Bitkom e. V.: Security of AI Agents. Grundlagen, Risiken und Best Practices (basics, risks and best practices), German only, accessed on 26.10.2026
85. Gartner, Inc.: The Latest Gartner Hype Cycle for Artificial Intelligence Puts Control Ahead of Capability, accessed on 26.10.2026
88. Federal Office for Information Security (BSI): KI-Agenten (AI agents), German only, accessed on 26.10.2026
89. Federal Office for Information Security (BSI): Basisschutz gegen Indirect Prompt Injections in dokumentbasierten LLM-Chats (baseline protection against indirect prompt injections in document-based LLM chats), German only, accessed on 26.10.2026
92. OWASP GenAI Security Project: OWASP Top 10 for Agentic Applications, Version 2026, accessed on 26.10.2026
98. Palo Alto Networks, Unit 42: OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat, accessed on 26.10.2026
100. NIST National Vulnerability Database: CVE-2026-25253, accessed on 26.10.2026
101. Censys: OpenClaw in the Wild: Mapping the Public Exposure of a Viral AI Assistant, accessed on 26.10.2026
103. Anthropic: Donating Agent Skills to the Agentic AI Foundation, accessed on 26.10.2026
104. Agentic AI Foundation (AAIF, Linux Foundation): Agentic AI Foundation announces four new projects, accessed on 26.10.2026
105. The Linux Foundation: Linux Foundation Announces the Formation of the Agentic AI Foundation, accessed on 26.10.2026
108. Anthropic: Agent Skills overview, accessed on 26.10.2026
109. agentskills.io (Agent Skills, at AAIF since 22.10.2026): Agent Skills Specification, accessed on 26.10.2026
111. NIST National Vulnerability Database: CVE-2026-25722, accessed on 26.10.2026
121. NIST National Vulnerability Database: CVE-2026-114463, accessed on 26.10.2026
124. Federal Statistical Office of Germany (Destatis): Nutzung von IKT in Unternehmen (use of ICT in enterprises, ICT survey 2025), German only, accessed on 26.10.2026
127. Eurostat: 20% of EU enterprises use AI technologies, accessed on 26.10.2026
130. McKinsey & Company: The state of AI in 2026: On the road to ROI, accessed on 26.10.2026