OpenClaw Alternatives in 2026: From Lighter Forks to Managed Agents

OpenClaw is the most-starred AI agent on GitHub, with 391,188 stars on October 2, 2026. It has also published 722 security advisories since January. Both numbers explain why people search for OpenClaw alternatives, and why the answers they find are hard to trust: two of the top five results rank the publisher's own product first, and a third puts its own at number two.

This guide sorts the options by the reason you're leaving instead. Every option gets the same columns, a dated source and at least one con. I make Octomind, which appears here as one of the managed options; for most of the reasons below it isn't the answer.

The short answer: Leaving over security, pick NanoClaw (every agent in its own container, keys held by a credential gateway) or keep OpenClaw inside NVIDIA's NemoClaw sandbox. For the closest like-for-like OpenClaw alternative, Hermes Agent imports your OpenClaw setup with one command. For a single-binary runtime on small hardware, ZeroClaw; to run no servers at all, a managed agent such as Claude's scheduled tasks, OpenAI Dots or Octomind octos; for fixed pipelines, n8n. If you haven't run openclaw security audit and turned the tool sandbox on, try that first, because it costs nothing.

Is OpenClaw safe? What the record shows (October 2026)

OpenClaw is reasonable for one person on one machine who sandboxes tools and installs nothing unread. It isn't built to separate people who don't trust each other, and its own security policy says so.

The OpenClaw vulnerability record from primary sources, checked October 2, 2026:

The first three landed together on January 31, all rated high and all fixed in v2026.1.29. The earliest was a command injection in Docker execution through the PATH variable, CVSS 8.8 (GHSA-mc68-q9jw-2h3v); the same day brought a one-click remote code execution through gateway token exfiltration, also CVSS 8.8 (GHSA-g8p2-7wf7-98mq). Of the 14 criticals that followed between February and April, seven are approval bypasses or scope escalations, several ending in remote execution on a paired node, and two get around the sandbox.

The ClawHub campaign was cruder: skills with a fake "Prerequisites" step that installed an infostealer (Atomic Stealer on macOS). OpenClaw answered with VirusTotal scanning for every published skill, and its own post warns that "a clean scan doesn't mean a skill is safe."

The trust model matters more than the count. OpenClaw's SECURITY.md describes "local-first agent infrastructure for trusted operators" and treats anyone who passes gateway auth as one of them. Exec runs on the host unless you enable sandboxing, an installed plugin runs in-process with the gateway's privileges, and prompt injection without a boundary bypass is out of scope. None of that is hidden. It means the risky setups (a Slack workspace where many people can message the agent, an inbox of untrusted mail, shell tools on the host) sit outside what the policy promises to defend.

Read the count fairly. Advisory volume measures scrutiny as much as code quality. n8n, the workflow tool below, has published 210 advisories, 22 of them critical. Hermes, NanoClaw and NemoClaw show none in their GitHub security tabs, which tells you they don't publish there yet, not that they have no bugs. Whatever you pick, our AI agent security checklist applies to it too.

OpenClaw alternatives compared: the decision table

The right-hand column is the decision rule. Stars and prices were checked October 2, 2026.

Try this first: harden the OpenClaw you already run

If security is your only complaint, three changes close most of the gap: run the audit, move tool execution into a sandbox, and keep the gateway on loopback. All three are documented, and none needs a new tool.

Start with the audit. --deep adds live gateway probes; --fix applies the safe fixes.

openclaw security audit --deep
openclaw security audit --fix

Know what --fix leaves alone. Per the security CLI reference, it flips open group policies to allowlists and tightens file permissions on config and credential files. It does not rotate tokens or API keys, disable tools, change your bind or auth settings, or remove plugins and skills. Those are on you.

Then edit ~/.openclaw/openclaw.json. These keys come from SECURITY.md and the sandboxing docs:

{
	gateway: { bind: 'loopback' },
	agents: {
		defaults: {
			// "non-main" sandboxes every session except your own main chat; "all" covers it too
			sandbox: { mode: 'all', scope: 'session', workspaceAccess: 'none' }
		}
	},
	tools: {
		fs: { workspaceOnly: true },
		exec: { applyPatch: { workspaceOnly: true } }
	}
}

The default sandbox backend is Docker, so it has to be running. Check what took effect with openclaw sandbox explain, which prints the effective mode, mounts and tool policy. Running the official container image? Its docs say images listen on an exposed address by default, so set gateway auth or bind to loopback. Pin the plugins you trust in plugins.allow. Skills are separate: restrict them per agent with the agents.entries.<agent>.skills allowlist, where an empty list exposes none (skills docs). Treat anything you leave enabled as code you're about to run with your own permissions.

Decision rule: if the audit is clean, the sandbox is on, and you still want out, your reason isn't security. It's upkeep, weight or cost, and the sections below map to those.

Leaving for security: NanoClaw vs OpenClaw, and NemoClaw vs OpenClaw

Both make an OS-level boundary the default, where OpenClaw ships with its sandbox switched off. NanoClaw replaces OpenClaw; NemoClaw keeps it and fences it.

NanoClaw: replace it with something you can read

NanoClaw (v2.4.0, September 23, 2026; 30,868 stars) started as a reaction to OpenClaw's size and its application-level security. Each agent group runs in its own Linux container and sees only the folders you mount. API keys never enter the container: outbound requests pass through a credential gateway that adds them at request time and applies per-agent limits.

git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2
cd nanoclaw-v2
bash nanoclaw.sh

The script installs Node, pnpm and Docker if they're missing, builds the agent container and pairs your first channel; if a step fails, it hands off to Claude Code to diagnose. That's also the catch. NanoClaw has no config files ("customization = code changes"), adds channels through Claude Code skills such as /add-telegram, and needs Claude Code for all of it. Claude is the default model through Anthropic's Agent SDK; /add-codex, /add-opencode and /add-ollama-provider switch a group to another backend. Its README documents no OpenClaw importer.

NemoClaw: keep OpenClaw, fence its network

NemoClaw is not a fork. It's NVIDIA's reference stack that installs OpenClaw (the default), Hermes or LangChain Deep Agents Code inside an OpenShell sandbox. Provider credentials stay outside the sandbox, network egress follows a YAML policy, and requests to unapproved destinations are blocked and surfaced for you to approve or deny. It's the closest thing in this list to a policy a security reviewer can read and sign off.

The cost is weight and maturity. The prerequisites ask for 4 vCPU, 8 GB RAM and 20 GB free disk at minimum (16 GB and 40 GB recommended), and the sandbox image is about 2.4 GB compressed. Linux and DGX Spark are the tested paths, macOS and WSL work with limitations, and native Windows is unsupported. The README calls it an alpha project, and the docs scope it to a trusted operator on one host, not a hosted or multi-tenant service.

Decision rule: NanoClaw if you'd rather replace OpenClaw and are happy to customize through Claude Code. NemoClaw if your skills and channels live in OpenClaw, you have a Linux box with 8 GB to spare, and egress control is the thing you're missing.

Leaving for the closest like-for-like: Hermes Agent

Hermes Agent from Nous Research is the nearest swap: one gateway process, chat channels, a cron scheduler, skills and long-term memory, MIT-licensed, with 250,673 stars. It also has the most complete OpenClaw importer of anything here; ZeroClaw's imports memory only.

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes claw migrate --dry-run              # preview what comes across
hermes claw migrate --preset user-data     # memories, skills and settings, no secrets

Per the Hermes README, the importer brings SOUL.md, the entries in MEMORY.md and USER.md, your skills (into ~/.hermes/skills/openclaw-imports/), the command allowlist, messaging settings and allowlisted API keys; AGENTS.md comes along with --workspace-target.

[AUTHOR: Have you run hermes claw migrate on a real OpenClaw workspace? One line on what didn't come across would help readers more than anything in the docs.]

The safety defaults are different, not absent. Hermes checks shell commands against a list of dangerous patterns, and in the default smart approval mode a helper model rates the risk: low-risk commands run, clearly dangerous ones are refused, and uncertain ones come to you. Cron jobs refuse dangerous commands by default. The production checklist tells you to set terminal.backend: docker, so plan on doing that rather than trusting the out-of-box setup.

Don't move to Hermes for calmer updates. It shipped five tagged releases in September 2026 against OpenClaw's seven on its main line. If updates that break your scheduled jobs are the reason, the fix is a managed agent where someone else does the upgrading.

Leaving for something lighter: ZeroClaw, and two meanings of "light"

"Lighter" means two different things, and the lists blur them. ZeroClaw is light to run: a single Rust binary you can register as a system service on a Raspberry Pi-class board. NanoClaw is light to read. I measured code size and download size on October 2, 2026.

Method: shallow clones, non-blank lines in TypeScript, JavaScript, Python, Rust, Go, Swift, Kotlin and Java, excluding test files (paths matched case-insensitively), Rust #[cfg(test)] blocks, docs, examples and vendored code; sizes from npm view openclaw and the GitHub release assets.

The size figures in circulation don't describe today's repositories: simular.ai gives OpenClaw 434,000 lines and NanoClaw about 3,900, and both the awesome-openclaw-alternatives list and DeepInfra call ZeroClaw a 3.4 MB binary. Counting methods differ, but no method turns 4.6 million lines into 434,000.

And ZeroClaw is light to deploy, not small to audit: its codebase is about 8 times NanoClaw's. If "I want to read what my agent runs" is the reason, NanoClaw is still the only option here where that's realistic, at under a fiftieth of OpenClaw's size.

ZeroClaw's own case is solid on its terms. zeroclaw quickstart writes a working config, zeroclaw service install registers a systemd, launchd or Windows service, and the README sets default autonomy to supervised, where medium-risk actions need approval and high-risk ones are blocked. Beyond Anthropic, OpenAI and local Ollama it supports about 20 more providers, and it drives GPIO and I2C on boards like the Raspberry Pi and ESP32. zeroclaw migrate openclaw --dry-run previews an import of your OpenClaw memory from ~/.openclaw/workspace (source). It's pre-1.0 (v0.8.5, September 5), and its README names zeroclaw-labs/zeroclaw as the only official repository; some lists still link an unaffiliated copy.

Leaving for cost: the agent is free, the model isn't

Every self-hosted option above is free software; OpenClaw's README says the project "has no paid tier, hosted service, or token." Your bill is tokens plus a host, so swapping agents rarely changes it. Swapping the model, or moving to a plan with a ceiling, does.

All five self-hosted options accept other providers, local models included: OpenClaw through its provider plugins, Hermes with hermes model, ZeroClaw through any OpenAI-compatible endpoint, NanoClaw with /add-ollama-provider, NemoClaw through its inference router.

Be careful with subscription workarounds. OpenClaw's own docs call routing a Claude subscription through a local proxy "not an officially sanctioned path", note that Anthropic has blocked such use before, and record that since Anthropic's June 15, 2026 update third-party usage draws from normal plan limits. A bill that depends on another company's policy page is not a predictable bill.

If the complaint is unpredictability rather than size, these are the ceilings on offer, checked October 2, 2026:

• Claude Pro: $20/month flat, with usage limits (Claude pricing).
• Nous Portal Plus (for Hermes): $20/month buys $22 of model credits (Nous Portal).
• n8n Cloud Starter: €20/month billed annually for 2,500 workflow executions (n8n pricing).
• Octomind Pro: $50/month including $50 of usage a month. Machine time draws from it too: a Small kept warm all month is $17.52 of it. Past that, prepaid credits at the same prices.

Decision rule: if the bill is too big, keep your agent and change the model. If it's too unpredictable, move to a plan with a ceiling.

Leaving to stop running servers: managed agents

A managed agent removes the gateway, the updates and the host. You give up self-hosting, and with two of the three, the choice of model lab.

Claude. On September 16, 2026, Anthropic merged Cowork into Claude: you hand over a task in any conversation and can schedule it to repeat. Cloud sessions run on Anthropic's servers and keep going with your laptop shut. By default Claude asks before taking an action, and you can let it carry on and check in only when needed. Pro is $20 a month ($17 billed annually), Max starts at $100. Models are Claude's only.

OpenAI Dots. Launched September 29, 2026 at DevDay: agents powered by GPT-6 Astra, available in ChatGPT for Pro and Business Premium users, reachable through Slack and Teams, with texting announced as coming soon (TechCrunch). OpenAI's own announcement page blocks automated reading, so I'm going on launch coverage here, and memory and pricing details beyond the plan requirement weren't published in what I could read.

Octomind octos (ours). An octo is one agent per workstream, with its own folder, memory, conversations and routines. Octos sleep when idle, cost only storage while asleep, and wake on a message or a scheduled routine. They answer in Telegram, WhatsApp, Slack, Discord, email and GitHub, and use any model in the catalog, billed at the provider's price plus 5%. Pro is $50 a month, $20 the first month, and holds up to 10 octos. The details are in meet your octos. Octomind Cloud also imports an OpenClaw folder directly: persona, memories, skills, cron jobs and the Telegram bot come over in one step (how the import works). The limits: there is no free cloud tier, Octomind Cloud is a managed service (the part you can self-host is the Apache-2.0 octomind CLI underneath), and octos on one machine share a user and a container, so an octo that handles sensitive credentials should get a machine of its own.

Decision rule: Claude if you live in Claude already and want scheduling today. Dots if you already pay for ChatGPT Pro. Octos if you want several agents scoped to separate jobs, on models from more than one lab.

n8n vs OpenClaw: when the job is a workflow, not an agent

n8n runs steps you draw; an agent decides the steps. If you can draw the job as a flowchart before it runs, n8n is cheaper to trust and easier to debug.

n8n (206,483 stars) ships an AI Agent node, an MCP client and server, and human approval for AI tool calls, so the fuzzy step can live inside a deterministic pipeline.

• The license isn't open source. Its Sustainable Use License allows use for your own internal business purposes or personal and non-commercial use. Fine for automating your own work; check it before you resell a hosted version.
• Pricing is per execution. Cloud Starter (€20/month billed annually) includes 2,500 executions, 5 concurrent, 5 minutes max each; Pro (€50/month billed annually) includes 10,000 and 40 minutes. A check every five minutes is about 8,600–8,900 executions a month by n8n's own count, so it outgrows Starter and fits Pro. Self-hosting the Community Edition costs nothing but your server.

Decision rule: n8n for "when X happens, do Y, then Z." An agent for "keep an eye on X and handle it." Many setups end up with both: n8n catches the webhook, and an agent handles the one step that needs judgment.

How to uninstall OpenClaw and move without losing anything

Your OpenClaw memory is plain Markdown, which makes the move easier than it looks.

1. Back up the workspace. OpenClaw keeps memory in ~/.openclaw/workspace: USER.md for preferences, MEMORY.md for durable facts, and dated notes in memory/ (memory docs).

   bash

   cp -R ~/.openclaw/workspace ~/openclaw-workspace-backup

2. Import. On Hermes, run hermes claw migrate --dry-run and then the real migration; on ZeroClaw, zeroclaw migrate openclaw --dry-run. On Octomind Cloud, Import takes the OpenClaw folder itself and brings memories, persona, skills, cron jobs and the Telegram bot over with a preview first. Everywhere else, paste the durable parts of MEMORY.md and USER.md into the new agent's instruction file, such as the group's CLAUDE.md in NanoClaw.

3. Preview the uninstall, then run it. The interactive prompt preselects only the gateway service, and state removal keeps workspaces unless you add --workspace (uninstall docs).

   bash

   openclaw uninstall --dry-run --all
   openclaw uninstall --all
   command -v openclaw   # should print nothing

4. Rotate every key OpenClaw held. Model provider keys, bot tokens for Telegram, Slack and Discord, and any OAuth grants. Deleting files doesn't revoke them, and any skill you ran had the same access the agent did.

What none of these fix (the honest version)

• Prompt injection. No option here makes an agent with a shell and an inbox immune. OpenClaw's policy says so outright; Hermes's default approval mode has a helper model judge commands the main model wrote; NanoClaw and NemoClaw limit the blast radius, not the manipulation.
• Sandboxes have bugs too. OpenClaw's September 11 advisories include a race in OpenShell filesystem path validation and a way for browser node targets to bypass sandbox host control (GHSA-crg9-c62w-j2p5, GHSA-9x88-f7rh-4c83). A sandbox is a layer, not a guarantee.
• The self-hosted options still need a terminal, and two need a container runtime. NanoClaw needs Docker and Claude Code for every customization; NemoClaw takes Docker Engine, Docker Desktop, Colima or rootless Podman, and needs 8 GB of RAM before your agent does anything.
• Managed means someone else's limits. Claude and Dots tie you to one lab's models and plans. Octomind has no free cloud, and octos run on its managed service (the part you can self-host is the open-source CLI).
• Zero published advisories is not zero bugs. It can simply mean a project doesn't publish advisories on GitHub.

Start Octomind Cloud on Pro — $20 your first month, then $50 a month with $50 of usage included.

FAQ

Is OpenClaw safe to use in 2026?

OpenClaw is reasonable for a single trusted operator who enables sandbox mode, keeps the gateway on loopback and installs only skills they've read. It had published 722 security advisories by October 2, 2026, including 14 critical, and its security policy treats prompt injection without a boundary bypass as out of scope. Run openclaw security audit --deep before deciding to leave.

What is the best free OpenClaw alternative?

For security, NanoClaw (MIT): agents run in containers and keys stay in a credential gateway. For the closest like-for-like swap, Hermes Agent (MIT), which imports OpenClaw memory, skills and settings with hermes claw migrate. All free options still bill you for the model you connect.

Is NemoClaw a fork of OpenClaw?

No. NemoClaw is NVIDIA's Apache-2.0 reference stack that runs OpenClaw, Hermes or LangChain Deep Agents Code inside an OpenShell sandbox with network policy and credentials kept outside. It's an alpha project and needs at least 4 vCPU, 8 GB of RAM and 20 GB of disk.

What are the Hermes Agent alternatives?

The same options that replace OpenClaw: NanoClaw for container isolation and a small codebase, ZeroClaw for a single Rust binary on small hardware, NemoClaw to sandbox Hermes itself, and managed agents (Claude, OpenAI Dots, Octomind octos) if you'd rather not run a server. n8n fits when the job is a fixed workflow.

Can I move my OpenClaw memory to another agent?

Yes. OpenClaw stores memory as Markdown in ~/.openclaw/workspace (USER.md, MEMORY.md and dated notes under memory/). Hermes imports it with hermes claw migrate, ZeroClaw with zeroclaw migrate openclaw, and Octomind Cloud with its Import page, which also brings skills, cron jobs and the Telegram bot; for other agents, copy the durable facts into their instruction file, such as CLAUDE.md in NanoClaw.