Open Source AI Agents Compared: OpenClaw, Hermes, Prime Agent, OpenCode...
On August 5, 2026, Prime Intellect released Prime Agent, a self-defined coding harness capable of rewriting its own prompts, skills, and even sub-agents while it works. The news quickly made the rounds of industry newsletters, not so much for its declared score on the ARC-AGI-3 benchmark (95.5%, above the reference human threshold), but for a more uncomfortable question: what really distinguishes one agent from another today? Until recently, it was enough to look at the model under the hood—GPT, Claude, Gemini, DeepSeek, open or proprietary. With the new generation of agents, this logic has broken down.
A modern agent is no longer just a model that answers a question. It is a system that adds persistent memory between sessions, tools to read and write files, access to a terminal, a browser to navigate, sub-agents working in parallel, a scheduler that decides when to act without anyone asking, skills that accumulate over time, a state to keep consistent, and, in some cases, the ability to modify its own operational rules. The model remains the engine, but the bodywork, the steering wheel, and the brakes are now a project in their own right, determining how much that engine can actually remember, execute, and learn.
It is worth immediately clarifying a frequent misunderstanding around the word "free". Open source software is one thing, self-hosted installation with no license costs is another, using free or paid models via API is yet another, and using models run locally is still another. These are independent variables that combine in different ways. OpenCode, one of the coding agents we will look at, I have used successfully multiple times with both free models like DeepSeek Flash and local models exposed via LM Studio: the cost of the agent is zero, the operational cost depends on the chosen model and the available hardware, not on a subscription to the software that orchestrates everything.
Three Families, Not a Single Ranking
Putting OpenClaw and OpenHands in the same direct comparison would make little sense, much like comparing a jack-of-all-trades butler to a foreman specialized in a single trade. It is useful to distinguish three families even before looking at individual features: autonomous personal assistants, designed to remain always available, accumulate information over time, and receive requests from multiple channels (OpenClaw, Hermes Agent); coding and research agents, oriented toward writing code, exploring repositories, and automating technical tasks (Prime Agent, OpenCode, OpenHands, Goose); and reference harnesses, useful more for understanding underlying architectures than for daily use (Pi, Letta).
OpenClaw, the Butler Living on Multiple Channels
OpenClaw is a multi-channel gateway that connects messaging apps like Telegram, Slack, WhatsApp, Discord, or iMessage to an always-active AI agent. The user installs a single Gateway process on their machine or on a server, and that process becomes the bridge between daily conversations and an assistant capable of executing shell commands, reading and modifying files, browsing the web, managing containers, and calling external APIs. Official documentation describes the core of the system as an agentic loop spanning four phases, from context assembly to model inference, tool execution, and state persistence.
The project has grown at an out-of-scale speed. After relaunching under the name OpenClaw in January 2026, it surpassed 200,000 stars on GitHub in just a few weeks, becoming one of the most followed repositories of the year, not only for the utility of the tool but because it imposed an architectural pattern that other projects then followed or explicitly cited.
The strengths are consistent with this setup: a large ecosystem of skills and integrations, persistent sessions that survive restarts, recurring activities programmable via cron and webhooks, and real access to the shell, browser, and file system that makes it more like an operational assistant than an enhanced chatbot.
Yet this very breadth is also its most obvious limitation. The more surfaces an agent touches, the more an attacker can exploit, and it is no coincidence that OpenClaw has in recent months become a true testing ground for research into AI agent security, as we will see in a dedicated section. Anyone installing it thinking of an always-active assistant that checks notifications, runs scripts, and works from Telegram without ever being restarted must account for a complex configuration and an attack surface to be managed carefully, not a sandboxed system ready to go.
Hermes Agent, the Agent That Writes Its Own Procedures
Hermes Agent is the open source project of Nous Research, a laboratory that has carved out a solid reputation in recent years in the field of open language models. The element that distinguishes it is not so much the breadth of its integrations, but its closed-loop learning cycle: after a complex activity, typically when multiple calls to different tools are needed, the agent can autonomously write a new skill, reuse it in subsequent sessions, correct it when it proves obsolete or incorrect, and preserve all this as persistent knowledge between conversations.
The project has reached over 215,000 stars on GitHub and couples the main engine with a satellite system of evolution, hermes-agent-self-evolution, which applies evolutionary search techniques to automatically optimize prompts, skills, and system behavior—work that found space as an oral paper at ICLR 2026. Beyond the technical language, the idea is simple: instead of just responding, the agent observes its own execution traces, understands why something did not work, and proposes better variants, with a mechanism that closely resembles natural selection rather than a simple static optimization rule.
Its strengths are persistent memory, automatic skill creation, support for multiple messaging platforms and development environments, and a multi-provider approach that does not tie the user to a single model provider. The limitation is equally clear and is admitted by the project's own documents: the quality of the system depends entirely on the quality of the skills it builds, and a learning cycle that does not distinguish between an effective procedure and one that only apparently works risks consolidating errors instead of correcting them. It is a bit like the problem that the novel House of Leaves by Mark Z. Danielewski stages on a narrative level: a structure that rewrites itself can expand in a fascinating way, but also lose its direction if no one checks where each new room leads.
Prime Agent, When Context Becomes a Variable
If Hermes represents learning via skills, Prime Agent represents an even more radical idea, applied not to behavior but to the very architecture of the agent. The project is based on two technical concepts that are worth translating into simple terms. The first, which I spoke about months ago here on the portal, is the Recursive Language Model, the idea that the context of a conversation should not be treated as a fixed stream of text to be compressed when it gets too long, but as a Python variable that the model can operate on programmatically, just as it would with any other data. The second is the Continual Harness, the part of the system that allows the agent to modify its supplementary instructions, memory, skills, and even the specifications of the sub-agents it uses in a trackable and reversible way, based on what it learned during execution.
In practice, instead of relying on a static list of predefined tools, the model works inside a persistent IPython kernel and can write code to invoke tools, launch sub-agents as nested functions, and preserve information outside the active context window, so that very long sessions do not lose access to what happened at the beginning.
In terms of results, Prime Intellect claims a score of 95.5% on ARC-AGI-3 using Opus 5, above the published human reference threshold for that benchmark, and competitive performance on long-context tasks using fewer tokens than traditional harnesses. These are interesting numbers, but they should be read with the caution that all benchmarks declared directly by product developers deserve: useful as an indication of direction, not as a definitive verdict until independent reproductions arrive.
The limitations are equally real. The learning curve is steeper than that of a traditional coding assistant, the project is still young compared to more mature tools, and the very ability to self-modify that makes Prime Agent interesting can amplify incorrect behaviors just as much as it amplifies correct ones. The execution of Python code and commands still occurs with the permissions of the user launching it, so the responsibility for isolating the environment remains entirely with the person configuring it.
OpenCode, OpenHands, and Goose: Three Different Roads to Code
If OpenClaw, Hermes, and Prime Agent focus on memory, learning, and recursive architectures, OpenCode, OpenHands, and Goose remain more anchored to the practical ground of software development, each with its own personality.
OpenCode is probably the best fit for the developer who wants freedom of choice without sacrificing structure. Usable from terminal, IDE, or desktop application, it offers specialized agents for planning and implementation, supports sub-agents and the MCP protocol, and is compatible with multiple model providers. In direct tests conducted with this tool, the software worked smoothly both with high-quality free models like DeepSeek Flash and local models exposed via LM Studio, confirming that the actual cost almost always depends on the chosen model and the available hardware, not on a subscription to the orchestration software. The flip side is that it is not designed as an always-active personal assistant, long-term memory is not its strong suit, and configuring providers sometimes requires manual intervention.
OpenHands operates on a register closer to an agentic engineering platform than a personal command-line tool. The agents it orchestrates can read and edit code, run commands, work directly on the files of a repository, and integrate with typical tools of the development cycle, from automatic issue resolution to test writing and refactoring. It is the most suitable tool for those who want to experiment with full software agent teams, but in return, it requires a more structured infrastructure and close supervision when tasks become completely autonomous.
Goose, developed by Block, focuses instead on a local and generalist approach. It runs on the user's machine, supports different models via the MCP protocol, and lends itself to heterogeneous tasks ranging from coding to technical research, writing, and data analysis. It is less centered on self-improvement compared to Hermes or Prime Agent, and its security depends directly on the permissions granted to it—a useful reminder: local execution reduces some risks associated with Internet exposure, but does not automatically equate to a secure environment.
Pi and Letta, Two Architectural References
Two projects deserve separate mention, not because they compete directly with the other six, but because they help us read them better.
Pi is a minimal harness for coding agents built around the opposite idea of OpenClaw or Hermes: instead of offering the maximum number of pre-built features, it provides an extensible base via skills, extensions, and packages, leaving the developer with the responsibility of composing the environment they actually need. It is interesting to note that the same terminal interface of Pi is reused by other projects on the list, including Prime Agent, a sign that in the open source agent ecosystem, certain components end up becoming shared infrastructure rather than the property of a single product.
Letta instead tackles the problem of memory and persistent state head-on, offering a platform designed to build stateful agents whose state can be managed, inspected, and evolved over time. It is a good reference point for distinguishing the simple preservation of a conversation history from true procedural learning—the difference that separates an agent that remembers what happened from one that actually learns something from that experience.
The Comparison in a Table
The values below are qualitative comparative ratings based on documentation and direct product use, not scores derived from standardized scientific benchmarks.
Security: The OpenClaw Case as a Lesson for All
A traditional chatbot produces text, an agent produces actions: it executes commands, reads and modifies files, accesses repositories, browses the web, sends messages, calls APIs, starts processes, and installs skills. The risk, therefore, does not depend only on the quality of the underlying model, but on the combination of model, granted tools, permissions, memory, and external content the system is able to read.
OpenClaw has become, almost in spite of itself, the most cited study case for understanding this dynamic, simply because it concentrates a very high number of these capabilities in a single environment. A research group from Texas A&M University published a systematic taxonomy in March 2026 based on 190 security advisories filed against the framework, organized by architectural level and type of trust violation, identifying paths that combine multiple vulnerabilities of moderate severity to achieve unauthenticated code execution on the host process. Other independent works have measured how risky skills installable via the project's marketplace can be: one research paper estimated that over a third of baseline-integrated skills present a high or critical risk level, while an analysis of the marketplace platform detected over a thousand packages considered malicious—about one in five among those available. Numbers of this type should always be taken as a snapshot of a precise moment rather than a permanent judgment on the project, because the landscape changes rapidly as developers release fixes.
Beyond specific numbers, the risks these works describe fall into a few recurring categories: prompt injection arriving from a web page visited by the agent or from a message received on a chat channel, exfiltration of sensitive data to the outside, third-party skills hiding harmful behaviors, excessively broad access to the file system, API credentials exposed by mistake, gateway instances reachable directly from the Internet, actions executed without explicit confirmation from the user, and finally, confusion between instructions given by the user and those that arrive hidden in the data the agent processes—a core problem that no tool has yet fully resolved.
This lesson does not concern only OpenClaw; it concerns the entire family of products described in this article, each with its own declination of risk. In Hermes Agent, an automatically generated skill can become a persistent procedure without anyone ever reviewing it line by line, making review, versioning, and rollback mechanisms necessary. In Prime Agent, a harness capable of modifying itself can consolidate an effective strategy just as much as it can consolidate an unwanted shortcut—the classic problem of reward hacking applied to architecture rather than just behavior. In OpenCode, the main risk concerns access to the workspace, terminal, and connected MCP servers, and it is always advisable to test in isolated repositories before granting broad permissions. In OpenHands, completely autonomous software tasks require dedicated containers, separate branches, automated test suites, and human approval before any merge. In Goose, finally, it is worth remembering that local execution does not automatically equate to security: an agent with access to the user's machine can still damage data or configurations even without ever touching the Internet.
From this comes a practical checklist that applies to anyone who wants to experiment with one of these tools, regardless of which one is chosen.
Conclusions, Without a Winner
Looking for an absolute winner among these eight projects would mean misunderstanding what AI agents have become this year. It makes more sense to think by scenario. OpenClaw remains the most natural choice for those who want a personal automation that lives on multiple messaging channels simultaneously. Hermes Agent is the most interesting project for those who want to closely observe a true learning cycle made of accumulating memory and skills. Prime Agent represents today the most advanced point of experimentation on the architecture of the harness itself, with all the risks and promises this entails. OpenCode offers the best balance for daily development, especially for those who want to remain free to alternate between free, local, or paid models. OpenHands is aimed at those facing complex software workflows that require multiple coordinated agents. Goose remains the most flexible choice for those looking for a generalist local agent without too many architectural constraints. Pi speaks directly to those who prefer to build their own harness starting from scratch. Letta, finally, remains the most useful reference for anyone who wants to seriously study what it means for a software system to truly have memory.
The real leap made by AI agents in recent months does not consist only in moving from a smaller to a more powerful model; it consists in building around the model an environment capable of remembering, using tools, coordinating activities, recovering from errors, and, in some cases, modifying its own way of working. The more this autonomy increases, however, the more security, audit, and human control stop being accessory functions to be added later and become an integral part of the architecture from day one.
Technical note: data on vulnerabilities, adoption, and benchmarks cited in this article derive from public sources available at the time of publication. As this is a very rapidly evolving sector, it is advisable to check the updated status of individual projects before any operational choice, especially regarding security patches.