Self-hosted always-on AI agents: OpenClaw, Hermes, Claude Agent SDK

Which self-hosted, always-on AI agent platform suits a long-running agent on a rented server? AR Labs surveyed the field in April 2026 to answer that question: runtimes that persist on a VPS, communicate through messaging apps, accumulate memory and operate autonomously. The survey is background to our multi-agent system, whose resident agents now run on Hermes. It compares OpenClaw, Hermes Agent, NanoBot, NanoClaw, PicoClaw, IronClaw, OpenFang, the Claude Agent SDK and newer entrants on architecture, security, memory and adoption, drawing on project repositories, release notes and press coverage.

History: this began as a March 2026 report, "OpenClaw & Always-On AI Agents", and was updated on 18 April 2026 with Hermes Agent, the Claude Agent SDK, new entrants, memory architecture trends and updated assessments across the field. The OpenFang section was added on 1 May 2026.

The landscape in April 2026

Five weeks passed between the March and April reports. The field moved from "OpenClaw vs alternatives" to a field of several players with differentiated architectures. Two structural shifts:

1. Hermes grew fastest: 96k stars, v0.10.0, shipping weekly. The learning-loop pattern is now the second-largest project in the space.
2. Claude Agent SDK went public: Anthropic's own agent runtime (the engine under Claude Code) is now a buildable SDK. Managed Agents, Anthropic's hosted agent runtime with built-in memory, entered public beta on 8 April 2026.

All seven alive and shipping. None stagnant.

The platforms

OpenClaw (359k stars)

The incumbent. A very large feature surface, 50+ messaging integrations, daily releases. Peter Steinberger (PSPDFKit founder, Austrian "vibe coder") officially joined OpenAI February 14, 2026 to lead "Next Generation of Personal Agents." The project moved to an independent open-source foundation with OpenAI as primary sponsor.

Naming history:

Notable since March 2026:

• Video/music generation tools, ComfyUI plugin
• Dreaming/memory-wiki: ChatGPT import ingestion, Memory Palace diary, REM backfill
• openclaw infer CLI hub for provider-backed inference
• Codex provider bundle (GPT-5.4-pro support)
• Security: markdown-it replaced marked.js (ReDoS fix), Slack allowlist bypass fix, media path canonicalisation
• Dashboard v2, 12-language UI

Assessment: Feature breadth unmatched but 430k+ LOC codebase. Configuration-driven, with no learning loop. In our own deployment and our reading of the built-in prompts (AGENTS.md, SOUL.md), those prompts steered models toward short, shallow answers, which made it a poor fit for analytical work; this is one operator's experience, not a published benchmark.

Installation:

npm install -g openclaw@latest
openclaw onboard

WARNING: Malicious lookalike packages exist on npm (e.g., @openclaw-ai/openclawai). Install only from the official source.

Hermes Agent (96k stars)

The fastest-growing project: from a niche project to the second largest in the field. Six major versions since March:

Learning loop: The defining differentiator. The hermes-agent-self-evolution repo (1.8k stars) handles autonomous skill improvement. Workflows above a complexity threshold (5+ tool calls, error recovery) auto-generate skill files. No comparable production system has replicated this.

Honcho integration: Now a pluggable memory provider (not baked in). Profile-scoped user modelling as an optional fourth memory layer.

Assessment: Went from "interesting but risky" to serious contender. The learning loop is its main differentiator. Risk: autonomous skill creation means opaque behaviour. At 26k LOC, less auditable than NanoBot but manageable.

NanoBot (40k stars)

Python, ~4,000 lines. The most auditable option with real community momentum.

Key development in v0.1.5.post1 (April 14):

"The agent learned to manage itself" -- self-context compression before context window overflows, follow-up message injection mid-turn, skill discovery from successful workflows.

NanoBot is absorbing the Hermes learning-loop pattern. Skill discovery from successful workflows is the concept arriving in a configuration-driven framework. This is the convergence signal.

Messaging: Telegram, Discord, WhatsApp, Slack, Email, QQ, DingTalk, Matrix Features: MCP integration, memory system, scheduling, skill system (AGENT.md + SOUL.md), prompt caching (including Anthropic) Site: nanobot.wiki

Assessment: Auditable codebase, Python-native (direct Graphiti/Mem0 import), gaining a learning-loop feature. Its SOUL.md prompt is inherited from the OpenClaw lineage, so it is worth reading the prompt before relying on NanoBot for analytical work.

NanoClaw (27k stars)

Security-first, built on the Claude Agent SDK. Docker partnership announced March 13, 2026.

Three isolation modes: Apple Container (macOS), Docker (standard), Docker Sandboxes (micro-VM). ONECLI_API_KEY forwarding for authenticated container config. Supply chain hardening with 7-day npm minimum release age.

Docker partnership details:

• First claw-based agent platform deployable inside Docker's MicroVM-based sandbox with a single command
• Every agent execution runs in a disposable Docker container: OS-level isolation, not application-level permission checks

Technical: ~500 LOC core (fully auditable in ~8 minutes). Handles scheduled tasks, persistent memory, channel integrations (WhatsApp, Telegram, Slack, Discord, Gmail). "Claw-Back" kill-switch for runaway processes.

Assessment: If Docker isolation matters, NanoClaw is the answer. 34.9k tokens, or 17% of a context window, is small enough for an LLM to reason about. For trusted agent use cases, such as a long-running agent on a VPS, the sandboxing is friction rather than value.

PicoClaw (28k stars)

Go, ultra-lightweight. Single binary, runs on ~10MB RAM. Targets $10 hardware (RISC-V, ARM, MIPS, x86).

Creator: Sipeed (hardware company, known for RISC-V boards) Messaging: Telegram, Discord, QQ Note: 95% of core code auto-generated by AI agents. Pre-v1.0, warns against production use.

Steady development, with nightly builds auto-publishing. Added Matrix CommonMark alignment, isolation support, hooks with respond actions.

Assessment: Best for constrained environments. Not relevant on a VPS where resources are not the constraint.

IronClaw (12k stars)

Rust, WASM sandboxing with capability-based permissions (zero access by default). Local PostgreSQL with AES-256-GCM encryption.

Creator: NEAR AI (Illia Polosukhin, co-author of "Attention Is All You Need") LLM support: Anthropic, OpenAI, Gemini, Mistral, Ollama MCP: Supported Messaging: Telegram

v0.25.0 adds what its release notes call production-grade coding tools, extensible deployment profiles, Composio third-party integrations, and a TUI in the default binary. "Skill repair learning loop restaged on staging": cross-pollinating from Hermes.

Assessment: The strictest security model of those reviewed. Low adoption (Rust niche) but real engineering. Worth watching for the WASM pattern, not for direct use.

OpenFang (17k stars)

Rust, single 32MB binary. Self-described "Agent Operating System": not a chatbot framework or Python wrapper, a full OS for autonomous agents. Built by the RightNow-AI organisation.

GitHub: github.com/RightNow-AI/openfang Site: openfang.sh / openfang.app Licence: MIT Version: v0.6.0 (April 19, 2026), pre-1.0, targeting stable mid-2026 Language: Rust (137,728 lines, 14 crates, 1,767+ tests) LLM support: 26 providers, 199 models. Ollama and LM Studio native. MCP: Full client + server (bidirectional). Also supports A2A (agent-to-agent mesh protocol). Messaging: 40 channel adapters, widest in class.

Architecture: 14 Rust crates:

7 bundled "Hands" (pre-built autonomous agents): Lead generation, Researcher, Collector (intelligence gathering), Predictor (superforecasting), Clip (media/content), Twitter (social media), Browser (web automation). Also includes a Coder template.

Security: 16 systems (the most of any platform reviewed):

• WASM dual-metered sandbox for all tool execution
• Ed25519 manifest signing (cryptographically signed agent manifests)
• Merkle hash-chain audit trail (tamper-proof)
• Taint tracking (data provenance)
• SSRF protection (network egress controls)
• Secret zeroisation (secrets wiped from memory after use)
• HMAC-SHA256 mutual auth
• GCRA rate limiter
• Subprocess isolation
• Prompt injection scanner

Memory: SQLite-backed with vector embeddings. Cross-channel canonical sessions (same agent identity across Discord, Slack, email). Automatic LLM-based compaction. JSONL session mirroring for auditability.

Assessment: Explicitly positioning as a secure alternative after OpenClaw CVE-2026-25253. Security posture surpasses IronClaw: 16 systems versus capability-based WASM alone. 40 channel adapters exceed OpenClaw's 50+ only in breadth, not depth. No learning loop; that remains Hermes's differentiator. Pre-1.0 with breaking changes between minor versions, so not production-stable yet by its own declaration. The Rust single-binary approach (32MB, no Python dependency) is architecturally clean. Worth serious evaluation once v1.0 ships. The A2A mesh protocol is unique: no other player has agent-to-agent communication built into the runtime.

TrustClaw (fragmented)

The name "TrustClaw" has been adopted by several unrelated projects:

New entrants since March 2026

ZeroClaw: Rust, ultra-lightweight

• github.com/zeroclaw-labs/zeroclaw
• Claims 99% lower RAM than OpenClaw. Targets cheap hardware.
• Strong YouTube traction (49k+ views on tutorials).
• Assessment: Competes with PicoClaw for the lightweight niche. Not architecturally differentiated.

Memoh: Go, container-per-bot

• github.com/memohai/Memoh, 647 stars, AGPL-3.0
• Each bot in an isolated Docker container with its own persistent memory.
• Matrix protocol support: federated messaging bridge.
• Messaging: Telegram, Discord, Lark/Feishu, QQ, Matrix, WeCom, WeChat, Email, Web.
• Assessment: Architecturally interesting for multi-agent deployment. Per-bot container isolation maps to running a coordinating agent, a research agent and a coding agent as separate containers. Low stars but a real project.

ForgeAI: TypeScript, enterprise focus

• github.com/forgeai-dev/ForgeAI
• Self-hosted. 7 security modules, multi-agent system, dashboard.
• Assessment: Enterprise positioning, not relevant for personal agent use.

AIDaemon: MCP-native daemon

• aidaemon.ai: "extend with MCP, powered by any LLM"
• MCP-native from the start (not bolted on).
• Assessment: Needs verification. The MCP-native angle is promising if real.

MoltWorker: Cloudflare serverless

• Run Moltbot/OpenClaw logic on Cloudflare's Sandbox SDK and Developer Platform APIs.
• No dedicated hardware needed.
• Assessment: Alternative for users who don't want a VPS.

Alternatives outside the claw family

n8n (visual workflow automation)

• 400+ integrations, native Telegram Trigger + AI Agent nodes.
• Self-hostable Docker deploy.
• Window Buffer Memory + Milvus/Zep for persistent memory.
• Best for: automation workflows ("if email arrives, summarise, send to Telegram"). Not an agent runtime.

AnythingLLM (document chat)

• Chat with your own documents (PDFs, code repos) via Telegram.
• Native "Telegram Bot Connector" in settings.
• RAG built-in, easy Docker deploy.
• Best for: document Q&A, not autonomous agent operation.

Letta / MemGPT (memory-first)

• Most advanced memory management (infinite context via OS-like memory paging).
• CLI-focused, harder to set up. "LettaBot" wrapper for Telegram.
• Best for: memory research. Competes with Graphiti/Mem0 rather than complementing them.

MindStone (second brain)

• Optimised for Claude + Obsidian/Logseq integration.
• MCP-based local markdown indexing. Proactive /brief and /extract commands.
• Best for: "second brain" use cases, not a general agent runtime.

DIY minimal (Python, aiogram and the Anthropic SDK)

# Total: ~100 lines, SQLite for memory, systemd for always-on
uv add aiogram anthropic aiosqlite

• Best for: maximum control, zero framework overhead, direct library integration.

Security

The ClawJacked vulnerability (CVE-2026-25253)

Disclosed: February 2026 Severity: High (remote full agent takeover)

Attack chain:

1. OpenClaw runs a WebSocket gateway on localhost
2. Browsers allow WebSocket connections to localhost (browser security gap)
3. Attacker embeds JavaScript on a malicious website
4. When a user visits the site with OpenClaw running, JS opens a WebSocket to the local gateway
5. OpenClaw trusted localhost traffic and exempted it from rate limiting, so the attacker brute-forces the password at hundreds of guesses per second
6. Once the password is guessed: silent device registration, full agent takeover

Fix: v2026.2.25 within 24 hours. v2026.3.12 introduced ephemeral device tokens as a systemic fix.

References:

• ClawJacked -- The Hacker News
• Oasis Security detailed writeup

Broader security concerns

Messaging platform security compared

Pragmatic choice for personal/coding use: Telegram, which is functional, widely supported and well served by libraries.

OWASP Top 10 for Agentic Applications (2026)

Now exists as a standard. Attack automation is outpacing human response speed. "Guardian Agent" patterns are emerging: small fast models sitting between the reasoning agent and the internet.

The Claude Agent SDK as an always-on platform

@anthropic-ai/claude-agent-sdk, 5,700 stars. The runtime that powers Claude Code, now a public SDK.

Managed Agents entered public beta on 8 April 2026, the date of Anthropic's announcement. Cloud-hosted sandboxing, long-running sessions, scoped permissions, and built-in memory that carries across sessions.

Self-hosting path documented at code.claude.com/docs/en/agent-sdk/hosting.

This represents a structurally different option from the claw family of platforms. Rather than wrapping an LLM in a messaging gateway, the SDK exposes the same agent runtime Claude Code uses, with CLAUDE.md, skills, hooks, file ops, shell, code understanding and tracing.

Assessment: Directly relevant to autonomous agent work. NanoClaw already builds on this. The open question is whether building directly on the SDK makes more sense than wrapping NanoBot or Hermes.

Memory architecture trends

A converging architecture

The field is converging on a layered hybrid:

Pure graph (Graphiti alone) is insufficient. Pure natural-language summary (Mastra alone) is fast but loses relational structure. The hybrid wins on benchmarks.

Anthropic's own memory features

1. Managed Agents memory (announced with Managed Agents on 8 April 2026): first-party persistent memory stores. Native, survives compaction, outside the agent loop. Could replace the need for third-party memory layers entirely.
2. Auto Dream / consolidation in Claude Code (March 2026): periodically reviews memory files, prunes stale data, resolves contradictions, reorganises. File-based (CLAUDE.md/memory files), not vector.

The context-file critique

ETH Zurich study (March 2026): naive append-to-context-file approaches degrade agent performance due to contradictions and recency bias. This validates consolidation cycles (OpenClaw dreaming, Auto Dream) and challenges raw CLAUDE.md accumulation.

MCP memory servers

• mcp-mem0 (coleam00): 653 stars. Connects Mem0's semantic memory to any MCP client.
• Redis Agent Memory Server: first-party Redis MCP server. Semantic search via RedisVL.
• shodh-memory: 45 tools, automatic memory capture on session end.

New memory systems

Key research papers

• arXiv 2603.07670: "Memory for Autonomous LLM Agents: Mechanisms, Challenges, and Future Directions" (March 8). Broadest academic survey.
• arXiv 2602.05665: "Graph-based Agent Memory: Taxonomy, Techniques, and Applications" (Feb). Formal taxonomy relevant to the Graphiti versus flat-vector debate.

Implications

Requirements for a long-running scheduled agent

A long-running agent on a VPS that runs scheduled work and reports through Telegram sets the following bar for a platform.

Must have: Scheduled execution, Telegram delivery, filesystem access, LLM routing without prompt suppression, persistent state, observability, Mem0/Graphiti integration capability.

Must NOT: Suppress model reasoning, enforce shallow-solution bias, require 500MB+ overhead, use opaque overriding prompts.

Three options

Option A: NanoBot + skill discovery. Auditable (4k LOC), Python-native, gaining the Hermes learning feature. Least disruption. Its SOUL.md prompts are worth reading for the same answer-shortening effect. Direct import graphiti_core path.

Option B: Hermes Agent. Most mature learning loop, 96k stars, shipping fast, Nous Tool Gateway. Best fit for an agent meant to accumulate operational competence. At 26k LOC, less auditable. Autonomous skill creation carries an opaque-behaviour risk.

Option C: Claude Agent SDK directly. Maximum control, native Claude Code capabilities, self-hosting documented. The team builds the runtime itself, with the maintenance burden and smaller community that implies. In exchange, existing CLAUDE.md, skills and hooks context engineering works natively.

Platform evaluation summary

What not to chase

• SIBYL 95.6%: single tweet, no paper. Treat as unverified until a methodology is published.
• ZeroClaw/PicoClaw: resource efficiency is not the constraint on a general-purpose VPS.
• ForgeAI: enterprise positioning, not a personal agent.
• LOCOMO benchmark: Mem0-adjacent, unclear independence.

VPS infrastructure considerations

1. RAM: OpenClaw/NanoClaw need ~1GB minimum; a 2GB VPS is recommended
2. Docker: NanoClaw requires Docker (Ubuntu 24.04 recommended)
3. Security: Never expose agent ports to the public internet; use SSH tunnelling or VPN
4. MCP Scoping: Only grant agent access to specific directories, never root/home
5. Human-in-the-loop: Enable approval mode for commands that modify files or send messages to new contacts

Sources

March 2026 (original report):

• OpenClaw - Wikipedia
• Peter Steinberger joins OpenAI | TechCrunch
• ClawJacked | The Hacker News
• Oasis Security: ClawJacked writeup
• NanoClaw + Docker | Docker
• NanoClaw Creator + Docker | TechCrunch
• Cloudflare Moltworker
• NanoClaw VPS Deploy Guide
• NEAR AI launches IronClaw | AIThority
• DataCamp: OpenClaw vs NanoBot

April 2026 (refresh):

• Three parallel research passes (platform updates, new entrants, memory architecture trends)
• Hands-on deployment experience with a long-running agent on a VPS (April 14-16)
• Our analysis of OpenClaw's built-in prompt conditioning