Muse vs Hermes Agent vs OpenClaw: who should run which

Three personal agents now compete for the same job, built by three very different organisations. Meta's Muse passed 2.5 million downloads in its first 13 days, as reported by CNBC on 21 September, and runs only on Meta's servers with Meta's model. Hermes Agent, from the venture-backed startup Nous Research, stood at 249,300 GitHub stars this morning and runs anywhere, on any model. OpenClaw, at 391,000 stars, belongs to a non-profit foundation and, as of Friday, is officially the runtime under Microsoft's new Copilot Autopilot. For a Swedish IT team the question is no longer whether personal agents arrive. It is which of the three shapes shows up on your network first, and which one you should sanction.

Three answers to the same question

All three products do the same thing on paper: a persistent agent that remembers you, reaches your messaging apps, holds credentials to your services, and acts without a prompt for every step. The differences start with who runs it and who is allowed to look inside.

Two of those rows decide most purchases. Muse is the only one you cannot host, and it is the only one with no EU availability. OpenClaw is the only one with a vendor standing behind an enterprise build. Hermes sits between them: the most flexible runtime of the three, a paid cloud behind it, and no enterprise story yet.

How each one stops the agent doing something stupid

A personal agent holds your email, your calendar, a bank connection and a shell. The interesting design question is not what it can do but what stops it. The three projects answer differently, and all three have published enough to compare.

Muse puts every user in a dedicated cloud VM, runs a separate Sentinel agent that approves or denies every outbound action, and never lets the model hold a real credential. The model sees a surrogate token; the real one is swapped in at the network boundary after Sentinel says yes. Part 1 covered the architecture and Part 2 the connector runtime. The trade is that none of it is inspectable. You take Meta's security post on trust, and Meta's own Help Center says custom connectors are not reviewed at all.

Hermes Agent documents what it calls a defence-in-depth model with eight layers. Dangerous-command detection runs in one of three modes, smart (an auxiliary model assesses the command), manual (always ask) or off, and a hardline blocklist stays active even in the mode the docs call YOLO: irreversible filesystem wipes, fork bombs and direct block-device writes are refused regardless. Approval prompts in the terminal offer once, session, always or deny. The messaging gateway denies everyone who is not on an allowlist or paired by DM, and pairing codes are eight characters, expire after an hour, and lock out after five failed attempts. Writes to credential stores such as the SSH and AWS directories are blocked. MCP subprocesses receive a filtered environment rather than the whole shell, error messages are scrubbed of tokens before they reach the model, and context files such as AGENTS.md are scanned for hidden instructions before they enter the system prompt. Docker containers run with all capabilities dropped and no new privileges. One caveat the docs are candid about: inside Docker, Modal or Singularity the dangerous-command check is skipped, because the container is assumed to contain the damage.

OpenClaw states its threat model in one sentence: "one trust boundary per gateway: a single operator, or a team whose members trust each other." It is explicitly not built for mutually adversarial users sharing one agent. Defaults are conservative: the Gateway listens on loopback, unknown DM senders get a pairing code instead of an answer, group access is allowlisted, and a single command, openclaw security audit, checks the configuration. Sandboxing is off by default, and when you turn it on the docs say plainly that it "is not a perfect security boundary, but it materially limits filesystem and process access when the model does something dumb." Version 2.0 added the two controls that matter most for a team: approvals now stay attached to the exact request, command, session and person that received them, and protected credentials can reach their destination without entering model-visible text.

OpenClaw also has something the other two do not: an independent audit. Trail of Bits reviewed core permissions and user-data handling under OpenAI's Patch the Planet initiative and the foundation published the outcome on 21 September. Twenty-four severity-rated findings, none critical, two high, sixteen medium, six low, all fixed and shipped in 2026.8.1 and the 2026.7.33 LTS release. The recurring theme was that permissions did not follow a request through multi-step work. That is precisely the class of bug you would expect in any agent runtime, including the two that have not been audited.

What one agent costs for a month

Price lists for the three look incomparable until you fix the scenario: one person, one always-on agent, for thirty days.

The table hides the real difference. Muse's price is a subscription with a merchant fee on top, and the token caps are generous because Meta wants the transaction volume. Hermes and OpenClaw cost whatever the model costs, which for an agent that runs all day on a frontier model can exceed a Muse Max plan. Nous's own pricing shows this: Portal credits of $22 on the $20 tier will not run a busy agent for a month, and the Super and Ultra tiers at $100 and $200 exist for that reason. For a team, compare the ceiling, not the sticker. Muse caps you. The other two send an invoice.

Microsoft picked one, and it tells you which to pilot

The most consequential fact for an enterprise reader arrived on Friday. Microsoft's Copilot relaunch on 25 September, announced by Jared Spataro, splits the product into Home, Code and Autopilot. Autopilot is described as a digital teammate that "lives in your tenant with its own identity, memory, computer and workspace, with permissions, audit and governance behind it," and it expands to private preview at the end of this month. Autopilot is the new name for Microsoft Scout, which Omar Shahine introduced on 2 June with the sentence "It is powered by OpenClaw open-source technology." The same day as the relaunch, the OpenClaw Foundation published a post titled "Microsoft Autopilot is built on OpenClaw. The contributions go both ways," quoting Shahine: "We are building Autopilot on @openclaw, working with @steipete and the OpenClaw Foundation to make it a fantastic enterprise grade runtime."

What Microsoft added is exactly the list a Swedish security team would write. Each agent gets its own governed Entra identity rather than a shared service account. Credentials are scoped per task and redacted from diagnostic logs. Purview sensitivity labels and data-loss-prevention policies apply before data leaves. Sensitive actions need a human. Deployment goes through Intune. What Microsoft contributed back is more interesting: a policy-conformance check that lets any OpenClaw operator, not only Microsoft customers, verify that model providers, network access and authentication are configured within their security requirements; a native Windows companion with command approvals and sandboxing built on Microsoft's own execution-container technology; and an Azure OpenAI provider.

Read that as a procurement signal. A team that learns OpenClaw now, self-hosted in Azure with the policy-conformance check switched on, is learning the runtime its Microsoft 365 tenant will run next year. Skills and approval habits transfer. The same is not true of Muse, which has no enterprise edition and no EU date, or of Hermes, whose only hosted tier is a consumer cloud. Hermes even ships a migration command, hermes claw migrate, that imports an OpenClaw installation's settings, memories, skills and API keys, which tells you which way the two projects think users move.

Who should run which

• A private individual in the US or Canada. Muse. It is the only one that needs no setup, the free tier is real, and the security architecture is stronger than what most people would build themselves. Just do not connect a work account to it.
• A developer who wants an agent in Telegram or Slack that improves with use. Hermes Agent. The self-improving loop, agent-curated memory and autonomous skill creation are its distinguishing feature, and the security documentation is the most detailed of the three. Run it in Docker, keep the dangerous-command mode on smart, and know that you are trusting Nous's defaults.
• Someone who wants everything on their own hardware, including the option of a small trusted team. OpenClaw. It is the only one of the three with no company that can change the terms, an independent audit on record, and a 2.0 release that took approvals and credential handling seriously. Sandboxing is off by default, so turn it on and run the security audit command before you connect anything real.
• An enterprise on Microsoft 365. Wait for Autopilot's preview and usage pricing, and pilot OpenClaw in the meantime under your own tenant so the team is fluent when it lands. Everything you learn carries over.
• A regulated Swedish organisation today. None of the three consumer products for corporate data. Self-hosted OpenClaw in Azure Sweden Central, behind Entra and with a Foundry model in the same region, is the pilot you can defend. Muse is unavailable, and a Hermes Cloud instance is a US company's server whatever its region.

The Swedish and EU angle

Muse cannot be installed in Sweden, and Meta has given no date. That closes the door on the consumer product but not on the pattern: a Swedish employee can install Hermes or OpenClaw this afternoon, pair it with Teams or WhatsApp, and hand it a corporate mailbox. Both projects default to denying strangers, but neither can stop the operator from granting themselves too much. Your acceptable-use policy almost certainly says nothing about a self-hosted agent that reads company mail, and it should.

Hermes Cloud deserves a specific note because its region list includes Stockholm, alongside Amsterdam, Paris, Frankfurt and London, and it picks the nearest location automatically. Data residency in Sweden is not the same as a processor you can contract with. The Portal's cloud and plan pages publish instance prices and regions; neither mentions a data processing agreement. Until Nous publishes one, treat Hermes Cloud as a personal tool, not a place for personal data belonging to your customers.

OpenClaw self-hosted in your own Azure subscription avoids the question: the agent, its memory, its credentials and the model endpoint all sit in Sweden Central under your tenant. Autopilot promises the same inside Microsoft 365, and the launch post's phrase "its own identity, memory, computer and workspace" is the right shape. Whether that computer respects the EU Data Boundary is not stated in the launch post, so ask before the preview, not after.

One more obligation has already started. Article 50 of the AI Act, applicable since 2 August 2026, requires that people be told when they are interacting with an AI system. An agent that writes to your suppliers from its own email address, which Muse announced at Connect and which any Hermes or OpenClaw operator can configure today, is that case exactly. Put the disclosure in the signature before the agent sends its first mail.

What to do this week

• Add self-hosted agents to your acceptable-use policy. Name Hermes Agent and OpenClaw, say whether corporate mailboxes and chat accounts may be connected, and say who approves it.
• Stand up one OpenClaw pilot in Sweden Central. Sandboxing on, the security audit command run, Entra in front, a Foundry model behind. Budget a week of one engineer's time.
• Run the policy-conformance check Microsoft contributed upstream, and keep the output. It is the closest thing to a compliance baseline any of the three has.
• Register for the Autopilot private preview if you are on Microsoft 365, and ask Microsoft two questions in writing: the usage-based price per agent-hour, and whether the agent's computer stays inside the EU Data Boundary.
• Write the AI disclosure line for any mailbox an agent can send from. It applies now, whichever runtime you end up with.