Over the last year, a new category of AI software has moved from hobbyist projects into real business use: the self-hosted AI agent. Three names come up most often — OpenClaw, Hermes and NemoClaw.

The challenge is that these tools sound similar and are often discussed together, even though they play different roles. Two of them are agents that do work for you. The third exists to keep the first two under control.

This article explains what each one is, how a business would use them, where the real risks are, and how they fit together.

1. What is a self-hosted AI agent?

A chatbot answers questions. An AI agent takes actions. It can read your files, watch your inbox, run on a schedule and complete multi-step tasks on your behalf.

Self-hosted means the agent runs on hardware you control — a laptop, a server or a cloud instance — rather than as a service someone else operates. Your data stays on your side.

A simple way to understand a self-hosted AI agent:

A self-hosted AI agent is a goal-oriented AI worker that runs on infrastructure you own.

That shift, from answering to acting, is where the value comes from. It is also where the risk comes from. Every capability that saves you time is a capability someone could misuse if they get between you and the agent. Keep that in mind, because it explains everything below.

2. What is OpenClaw?

OpenClaw is an open-source, self-hosted personal AI agent. You connect it to a large language model, and it connects to the tools you already use: your files, your calendar, your messaging apps, your browser.

Two features define it:

• A scheduled "heartbeat" that lets OpenClaw wake itself on a timer to check a folder, a database or an inbox and act without being prompted.
• A modular skill system that lets you give the agent reusable, task-specific routines.

You usually talk to it through a messaging app such as Telegram or WhatsApp.

A simple way to understand OpenClaw:

OpenClaw is an agent you run yourself that can act on a schedule, not just when you ask.

OpenClaw started as a side project in late 2025 and grew into one of the most-starred open-source projects on GitHub. For a business, that popularity cuts both ways: there is a large community and many integrations, but the software is young, and its security maturity lags well behind its features.

3. What is the Hermes agent?

Hermes is a comparable self-hosted agent, built by Nous Research and released in early 2026. Like OpenClaw, it runs on your own machine and reaches you through Telegram, Discord, Slack, WhatsApp, Signal or the command line. Its emphasis is on learning over time.

Its distinguishing idea is a built-in learning loop:

• When Hermes solves a hard problem, it writes the solution up as a reusable skill so it does not have to work it out again.
• It builds a persistent model of your projects and preferences across sessions.
• It bundles web search, browser automation, vision and image generation, while keeping data on your machine.

A simple way to understand Hermes:

Hermes is a self-hosted agent that learns and remembers as it works.

In practice, OpenClaw and Hermes solve the same problem — an always-available assistant that acts for you — with different bets. OpenClaw leans on scheduled autonomy; Hermes leans on accumulated skill and memory. NVIDIA's security layer, covered below, supports both.

4. How you would actually use one

Consider a small consulting team that loses every Friday to writing client status updates. A self-hosted agent can take most of that off their plate:

1. 1.

   On a schedule (OpenClaw's heartbeat, or a Hermes routine), the agent runs at 8am on Friday.
2. 2.

   It reads that week's entries from the team's time-tracking export and project notes in a local folder.
3. 3.

   It drafts a short status summary per client — work completed, hours logged, next steps — in the team's usual format.
4. 4.

   It posts the drafts into a private Slack or Telegram channel for a human to review.
5. 5.

   A team member edits and approves. Only then does anything reach a client.

The value is concrete: a two-hour task becomes a ten-minute review. Notice the design choice that keeps it safe — the agent drafts and stages, a person approves, and nothing leaves the business automatically. That "a human signs off before anything external happens" pattern is the most important habit when working with agents. It also points directly at the risks.

5. What are the risks?

The capabilities that make agents useful — reading your data, reaching the internet, acting without a click — are exactly what make them dangerous when something goes wrong. These risks are documented, not hypothetical.

Prompt injection. A prompt injection hides instructions inside content the agent is asked to process — a web page, an email, a document. If the agent treats those hidden instructions as legitimate, it does something you never asked for.

A simple way to understand prompt injection:

Prompt injection is a hidden instruction smuggled into content the agent reads, causing it to act against your interest.

Silent data exfiltration. Security researchers showed that OpenClaw's link-preview behavior in messaging apps could be turned into a data-theft channel. The agent is tricked into generating an attacker-controlled URL; when the messaging app renders that link's preview, confidential data is sent to the attacker's domain — with no click required. The danger is not the agent doing something visibly wrong, but doing something invisibly wrong.

Weak defaults and broad access. Analyses from Microsoft's security team point to weak default configurations and limited input validation. To act on your behalf, the agent holds privileged access to your system. If it is compromised, that access becomes the attacker's access.

For a business, the summary is simple: an unsandboxed agent with access to sensitive files and an open path to the internet is a liability, however helpful it is on a good day.

6. What is NemoClaw?

NemoClaw is NVIDIA's open-source security layer for running agents like OpenClaw and Hermes. It does not replace the agent. It wraps the agent in a controlled environment so its power is bounded.

A simple way to understand NemoClaw:

NemoClaw is a security wrapper that runs the agent inside a locked room and controls what it can reach.

It was released in March 2026 and is free and open-source.

7. How NemoClaw addresses the risks

Three mechanisms do most of the work:

• Isolation. NemoClaw runs the agent inside a sandbox (built on NVIDIA's OpenShell) that limits network access, filesystem access and process privileges. If the agent is compromised, the damage is contained to the sandbox, not your whole system.
• Default-deny networking. When the sandbox starts, the agent can reach exactly one external endpoint — its configured AI provider — and every other outbound connection is blocked. The silent data-theft trick depends on reaching an arbitrary attacker domain; under default-deny, that connection simply fails.
• Approval on exceptions. When the agent tries to reach a host that is not on the allowed list, NemoClaw blocks the request and surfaces it for a human to approve or deny, showing the host, port and requesting process. You decide, rather than finding out afterward.

Together, these turn the agent's implicit "reach anything" posture into an explicit "reach only what is approved" one.

Two honest caveats. NemoClaw is alpha software, and by NVIDIA's own account it does not yet provide multi-tenant governance, PII scanning, content-safety guardrails, cost attribution or role-based access control. It also relies on NVIDIA's ecosystem for local AI processing. It meaningfully reduces the network and isolation risks, but it is not a complete security program on its own.

8. How these pieces fit together

A simplified example:

1. 1.

   A hook or schedule starts the agent on Friday morning.
2. 2.

   OpenClaw (or Hermes) reads local project files and drafts client summaries.
3. 3.

   NemoClaw keeps the agent sandboxed and blocks any unexpected outbound connection.
4. 4.

   A human reviews and approves the drafts before they are sent.

This is how a self-hosted agent moves from an interesting demo to something a business can rely on.

9. Why this matters for businesses

For a decision-maker, the point is not the product names. The point is understanding that the agent is only half of the system. The other half is the control around it.

A self-hosted agent can remove genuine drudgery — recurring reports, inbox triage, routine research — while keeping data on infrastructure you own. But the moment it can read your files and reach the internet, it needs:

• A sandbox that limits what it can touch
• A strict network policy, so data cannot leave quietly
• Clear human approval points before anything external happens
• Monitoring and logging of what the agent did

This is where many AI-agent projects go wrong. Teams focus on the agent's capabilities and underestimate the architecture around it. The value is not created by the agent alone. It comes from connecting that capability to your business context safely.

Conclusion

OpenClaw and Hermes are powerful, and NemoClaw is an important step toward running them responsibly. But an agent is only one part of a working system. To use one in a real business, you need the surrounding architecture: isolation, network control, human approval and monitoring.

At ITGRATE, we help businesses move from AI ideas to working, dependable systems. Whether you are exploring internal AI assistants, workflow automation or agent-based applications, the right starting point is a clear understanding of your processes, data and integration needs. If that is on your roadmap, we are happy to talk it through.

A safe AI agent does not begin with capability. It begins with control.