OpenClaw Alternatives in 2026: 5 Self-Hosted AI Agents

OpenClaw is the breakout open-source project of 2026. It started in November 2025 as Clawdbot, a personal AI assistant you talk to through WhatsApp, Telegram, or iMessage. It was renamed Moltbot after a trademark complaint from Anthropic, became OpenClaw three days later, and passed 390,000 GitHub stars by September. Its creator joined OpenAI in February, and the project now belongs to a non-profit foundation.

Fame brought scrutiny. Within weeks of going viral, OpenClaw was dealing with malicious skills in its marketplace, a critical remote code execution bug, tens of thousands of instances exposed to the internet, and companies banning it from work laptops. A wave of OpenClaw alternatives followed, most built to be smaller, safer, or both.

This guide compares the 5 best open-source OpenClaw alternatives in 2026, plus one way to keep OpenClaw and run it more safely.

TL;DR: Hermes Agent is the most capable OpenClaw alternative and imports your OpenClaw setup in one command. NanoClaw is the pick if isolation matters most, since every session runs in its own container. ZeroClaw is the lightest full-featured option, a single Rust binary with approvals on by default. The full comparison table is further down.

The Baseline: OpenClaw

OpenClaw is a gateway that sits on your machine and connects one AI assistant to more than 20 chat apps, including WhatsApp, iMessage, Slack, Discord, Signal, and Telegram, plus native apps on every desktop and mobile platform. It can use hosted or local models, run tools and skills, and act on your behalf around the clock. It is MIT-licensed, run by the OpenClaw Foundation (a 501(c)(3) whose donors include OpenAI, Amazon, and Red Hat), and has no paid tier.

People look for alternatives for four reasons:

• Security incidents. In February 2026, researchers at Koi Security found 341 malicious skills on ClawHub, OpenClaw's skill marketplace, that stole credentials and installed reverse shells; later counts reached 824. A one-click remote code execution flaw (CVE-2026-25253) let a malicious link take over an instance until it was patched in version 2026.1.29. Scans found tens of thousands of exposed instances, and Meta told staff to keep OpenClaw off work devices.
• The default security model. OpenClaw's own README says tools run on the host for the main session unless you configure sandboxing. Many people never do.
• Cost. The default heartbeat re-sends the full conversation context every 30 minutes, and users have reported spending $50 a day on premium models.
• Size. The core is over two million lines of TypeScript, before its 172 bundled extensions. Few people can audit what they are running.

To be fair to OpenClaw, the foundation now employs a full-time team, the CVE was fixed within days, and the hundreds of published security advisories reflect how much attention the project gets. If you already run it, see the NemoClaw section below before you switch.

How We Picked

Every alternative below is open source, self-hosted, reachable through chat apps the way OpenClaw is, and actively maintained as of September 2026. We compared their security model, footprint, chat channels, local model support, and whether they can import an existing OpenClaw setup. We track all of them in AI Personal Assistants.

The 5 Best OpenClaw Alternatives

1. Hermes Agent

Hermes Agent from Nous Research is OpenClaw's closest rival in scale, with more than 248,000 GitHub stars. Where OpenClaw focuses on being reachable everywhere, Hermes focuses on getting better over time: it saves successful tasks as reusable skills, refines them on the next run, and keeps searchable memory of past sessions. It covers around 28 messaging platforms, from Telegram, WhatsApp, and Signal to email, SMS, and Home Assistant.

Moving over is straightforward. hermes claw migrate imports your OpenClaw settings, memories, skills, and keys. Hermes works with more than 300 models and with local ones through Ollama, vLLM, SGLang, llama.cpp, or LM Studio, and it can run its commands in seven backends, including Docker, SSH, Modal, and Daytona. A desktop app and web dashboard arrived in June 2026.

Key Features and Considerations

Hermes is not a lightweight option. It is a large Python project that moves fast, and like OpenClaw it runs commands on the host by default, so pick a container backend for anything important. Local models need at least 64K tokens of context. The agent is MIT-licensed and free; Nous Portal plans ($20 to $200 a month) are optional and bundle models, search, and other tools under one key.

• Pros:
  • One-command migration from OpenClaw.
  • Self-improving skills and long-term memory.
  • Around 28 messaging platforms and 300+ models.
• Cons:
  • Host execution unless you choose a sandboxed backend.
  • Large codebase and a heavy install.

Website: https://hermes-agent.nousresearch.com

2. NanoClaw

NanoClaw was built as a direct response to OpenClaw's security problems. Every agent session runs in its own Docker container, and your credentials never enter it: a gateway injects them into outgoing requests only when needed. The codebase is small enough to read: its site counts around 200 files and 12 dependencies, against thousands of files for OpenClaw. A partnership with Docker adds an optional micro-VM layer on top.

Configuration works differently: there are no config files. You fork the project, and Claude Code edits your fork to add channels or change behavior. Channels install on demand and include WhatsApp, Telegram, Slack, Discord, Teams, Signal, iMessage, and Matrix. Claude is the default model, with Codex, OpenCode, and local Ollama models available per agent group. Version 2.0 in April 2026 was a full rewrite, and the company behind it raised a $12 million seed round in May.

Key Features and Considerations

NanoClaw is built around Anthropic's tools. Customizing it requires Claude Code, and the default model (Claude Opus) is not cheap to run all day. Docker is mandatory, there is no dashboard, and releases often include breaking migration steps. It runs on macOS and Linux, and on Windows through WSL2.

• Pros:
  • A container per session, with credentials kept outside it.
  • Small, auditable codebase.
  • MIT license, free to self-host.
• Cons:
  • Claude-first, and customizing requires Claude Code.
  • No dashboard; frequent breaking changes.

Website: https://nanoclaw.dev

3. ZeroClaw

ZeroClaw is a from-scratch rewrite in Rust: one binary of about 26 MB, configured with a single file. It reads the same skill format as OpenClaw, and zeroclaw migrate openclaw imports your existing memory. It supports more than 30 chat channels and 70 model providers, including local models through Ollama, LM Studio, llama.cpp, and vLLM.

Its defaults are the most cautious on this list. Autonomy is "supervised" out of the box: medium-risk actions wait for your approval (as in the screenshot above) and high-risk ones are blocked. Tools can run inside OS-level sandboxes (Landlock, Bubblewrap, Seatbelt, or Docker), memory can live in SQLite, Postgres, or Qdrant, and it can even control hardware pins on a Raspberry Pi or ESP32. It is dual-licensed MIT or Apache-2.0.

Key Features and Considerations

ZeroClaw is still pre-1.0, and it shows: the configuration format has changed three times, and upgrades regularly break setups. The prebuilt binaries include only a handful of channels, so Slack, Signal, iMessage, and many others require building from source. There is no subscription; a hosted routing service is in beta.

• Pros:
  • Approvals on by default and OS-level sandboxing.
  • Tiny single binary with OpenClaw migration.
  • 30+ channels and 70+ providers.
• Cons:
  • Frequent breaking config changes.
  • Many channels require building from source.

Website: https://www.zeroclaw.com

4. nanobot

nanobot comes from the Data Intelligence Lab at the University of Hong Kong and launched in February 2026 as a tiny, readable take on Clawdbot. It has grown into a full personal agent with a polished web interface, a terminal UI, a Python SDK, and an OpenAI-compatible API, and at 48,000 stars it is the most popular Python alternative after Hermes.

It connects to Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Teams, email, and the major Chinese platforms, and works with local models through Ollama, vLLM, or LM Studio. "Dream" long-term memory, a skills marketplace, scheduled automations with a calendar, MCP support, subagents, and a /goal command for long-running objectives round it out. The September release added side-by-side conversation panes.

Key Features and Considerations

The "ultra-lightweight" label from launch no longer fits: the core is still compact, but the full package has grown large. More importantly, its command sandbox is opt-in (and unavailable on Windows), and the project has published five security advisories, two of them critical, including an authentication bypass. Keep it updated and turn the sandbox on. It is MIT-licensed and free.

• Pros:
  • Clean web UI with multi-pane conversations.
  • Wide channel coverage, including Chinese platforms.
  • MIT license and local model support.
• Cons:
  • Sandbox off by default.
  • A track record of critical advisories.

Website: https://nanobot.wiki

5. IronClaw

IronClaw from NEAR AI is the security-maximalist option, a Rust "agent OS" built to answer OpenClaw's weaknesses one by one. Untrusted tools run in a WebAssembly sandbox with explicit permissions and an allowlist of endpoints they may reach. Secrets are encrypted at rest and injected at the boundary, so neither the model nor the tools ever see raw credentials. It adds leak detection and prompt-injection defenses on top.

Twelve built-in extensions cover GitHub, Gmail, Google Calendar, Drive, Docs, Notion, and Slack, and it works with 26 model providers, including Ollama and any OpenAI-compatible endpoint. Hosted instances on NEAR AI Cloud run inside a trusted execution environment, with a free starter plan (one agent, $5 of credits) and paid plans from $20 a month. The software is dual-licensed MIT or Apache-2.0.

Key Features and Considerations

Version 1.0 in July 2026 was a ground-up rebuild with no upgrade path from 0.x, and it shipped with only two chat channels, Slack and Telegram, plus a web chat and terminal. Several commands are still unimplemented, and the project is tied closely to the NEAR ecosystem. There is no OpenClaw importer in the current version.

• Pros:
  • The strongest isolation model: WASM sandbox and encrypted secrets.
  • Hosted option in a trusted execution environment.
• Cons:
  • Only two chat channels in v1.
  • Young rebuild with known gaps.

Website: https://www.ironclaw.com

What About PicoClaw?

PicoClaw, a tiny Go assistant from hardware maker Sipeed that runs on $10 boards, was one of the most talked-about alternatives in early 2026. We left it out on purpose. It has had a single commit since late July, its website's security certificate expired on September 10, and recent bug reports, including one marked critical, have gone unanswered. Its own README already warned against production use before version 1.0. If you want a small footprint, ZeroClaw is the actively maintained option.

Or Keep OpenClaw and Sandbox It: NemoClaw

If you like OpenClaw and mainly worry about what it can reach, NemoClaw from NVIDIA may be the better fix. It is not a replacement but a reference stack that runs OpenClaw (or Hermes Agent) inside NVIDIA's OpenShell sandbox. Network and filesystem access follow a policy file, unapproved outbound connections are blocked and shown to you for review, credentials stay outside the sandbox, and you can snapshot and restore the whole environment.

It is Apache-2.0 and free, works with hosted models or local ones through Ollama, vLLM, and llama.cpp, and runs on Linux, macOS, and WSL. It needs at least 8 GB of RAM (16 GB recommended) and Docker or Podman. NVIDIA labels it an early preview for a single trusted operator, and its chat channels are not yet recommended for production.

Broader Agents Worth a Look

Not every OpenClaw user needs another chat-app assistant. If what you really want is an agent that gets work done, Agent Zero gives an agent its own Linux desktop inside Docker, Goose is a general-purpose desktop and CLI agent under the Linux Foundation, and Eigent runs a team of agents on your desktop. We compare them in our guide to the best open source AI agents.

Comparison Table

Legend: ✅ yes · 🟧 partial or with caveats · ❌ no · "Isolation by Default" describes where the agent's commands run on a fresh install. Stars are GitHub stars as of September 2026, when all licensing, pricing, and security details in this article were last verified.

Which OpenClaw Alternative Should You Choose?

• You want the most capable replacement and an easy move: Hermes Agent. Run the migration command and pick a container backend.
• You want every session isolated and a codebase you can read: NanoClaw, if you are comfortable in Anthropic's ecosystem.
• You want a small binary with approvals on by default: ZeroClaw.
• You want a friendly web UI and Python internals: nanobot, with the sandbox switched on.
• Security is the whole point: IronClaw, accepting fewer channels for now.
• You want to keep OpenClaw but contain it: NemoClaw.

If you are coming from a proprietary assistant instead, we also keep lists of open-source Manus alternatives and Msty Claw alternatives.

Frequently Asked Questions

What is the best OpenClaw alternative?

For most people, Hermes Agent is the best OpenClaw alternative: it matches OpenClaw's reach across chat apps, adds self-improving skills and memory, and imports an existing OpenClaw setup in one command. If security matters more than features, NanoClaw and ZeroClaw isolate the agent by default.

Is OpenClaw safe to use?

OpenClaw can be run safely, but not with its defaults. Keep it updated, enable sandboxing (tools run on your machine otherwise), never expose the Control UI to the internet, and review every ClawHub skill before installing it, since hundreds of malicious skills were found there in 2026. Tools like NemoClaw add a sandbox around it.

What happened to Clawdbot and Moltbot?

They are the same project. Clawdbot launched in November 2025, was renamed Moltbot on January 27, 2026 after a trademark complaint from Anthropic, and became OpenClaw on January 30. Scammers used the renames to push fake accounts and a crypto token, so only trust the official openclaw.org site and GitHub organization.

Can I migrate from OpenClaw to another assistant?

Yes. Hermes Agent imports OpenClaw settings, memories, skills, and keys with hermes claw migrate. ZeroClaw imports memory with zeroclaw migrate openclaw and reads OpenClaw's skill format, so many skills carry over. Other alternatives need a manual move of your prompts and skills.

How much does it cost to run OpenClaw?

The software is free, but model usage adds up. OpenClaw's default heartbeat re-sends the full context every 30 minutes, and users running premium models have reported around $50 a day. Longer heartbeat intervals, cheaper models for routine work, or local models through Ollama bring the cost down sharply.

Hermes Agent vs OpenClaw: what is the difference?

OpenClaw focuses on being available everywhere, with 20+ chat apps and native apps on every platform. Hermes Agent focuses on learning, turning completed tasks into reusable skills and building long-term memory. Both are MIT-licensed and self-hosted; our Hermes Agent vs OpenClaw comparison goes deeper.

Final Thoughts

OpenClaw proved that people want a personal AI that lives in their chat apps, and it also showed what happens when software with access to your email, files, and accounts grows faster than its security model. The alternatives above mostly split along one line: some chase OpenClaw's reach (Hermes Agent, nanobot), and others trade features for isolation (NanoClaw, ZeroClaw, IronClaw). Whichever you choose, the same rules apply: sandbox the agent, give it its own credentials, and review what it installs.

We'll keep the AI Personal Assistants category updated as the field moves. If you build or use an OpenClaw alternative we should know about, submit it to OpenAlternative.