People migrating off OpenClaw keep asking whether Hermes Agent is the safer choice. Short answer: neither is “the safe one”. They share the same architecture, cloud brain, terminal privileges, plugin supply chain, and that architecture is where the risk lives. Swapping the logo does not swap the blast radius.
Here is why I stopped caring which harness wins.
DeepSeek Harness shipped on August 13, 2026. Stars went stupid overnight. Plugins started showing up within hours. The tagline on the repo is right there: “Everything is a Plugin”.
I’m not a developer. I’m a PM who lives in docs, research, and half-finished projects. Still, I kept hearing the same pitch from people who are: Claude Code, Codex, OpenCode, Pi, Hermes, now dsh. It runs on your machine. Sees your files. Feels safer than pasting stuff into a browser tab.
I almost believed that.
Then I sat with the security writeups from this week and a few older ones that suddenly rhyme. Short version:
Local is where the hands sit. It is not where the brain sits, and it is not a smaller blast radius.
The calm you feel when the icon lives on your laptop is doing a lot of unearned work. Five problems. Not one slogan.
1. Privacy: the upload you didn’t choose
Most of these tools are not running a full model under your desk.
What usually happens each loop: the agent reads files, tree listings, terminal noise → packs that into context → sends it to a cloud API → gets the next tool call → does it again.
Claude Code talks to Anthropic. Codex talks to OpenAI. DSH can point at different backends, but “I installed a local agent” still usually means local hands, remote brain. Open harnesses are the same story unless you deliberately wire a true offline model and accept the quality hit.
That already breaks the bedtime story. The sharper part is who picks the files.
When you upload something by hand, you know what you handed over. With a local agent, relevance is its job. It walks the tree. It pulls the neighbor folder. The contract PDF next to the ticket. A .env that showed up after a failed command. Chat exports sitting in Downloads. Notes you forgot were still on disk.
You said “help me fix this”. You did not say “go find whatever looks useful and stream it off my machine”.
So if privacy is why you wanted local, look at the architecture first. A lot of “local-first” is really local actuator + cloud cognition. The packaging changed. The data still leaves. And unlike a manual upload, you often cannot even list what left.
2. Security: full machine privilege, four ways in
Chatbots mostly talk. Agents act as you.
Terminal access on a normal laptop is not a toy sandbox. It is ambient authority: shell as your user, home directory, SSH keys, cloud CLIs, sometimes browser sessions and password-manager material, project configs, outbound network that looks like normal tooling.
On top of that privilege, four paths keep showing up. None of them are fan fiction anymore. Break any one of them and you are not “leaking one app’s data”. You are exposing whatever that account can touch. On a personal machine, that sentence gets ugly fast.
2a. The software has holes
This week is the fresh receipt.
Within about a day of launch, people started publicly documenting serious issues in early dsh builds. One thread is about the browser dashboard that ships with dsh (verified on 0.1.0-rc.6). Plain version: the dashboard is a little web server on your machine, and it has no login. It does check where a request claims to come from, which stops some browser-based tricks, but that’s a doorman glancing at a business card, not a lock. Any other program already running on your machine can walk up to that port, start agent sessions, loosen the permission settings, and have the agent run shell commands as you. And if the server is ever exposed beyond your own machine, the same no-login design turns remote.
Earlier in 2026, OpenClaw (also discussed as Clawdbot / Moltbot) had CVE-2026-25253: auth token theft leading to remote code execution on a local agent stack. Different repo. Same moral. When the product is “agent with your user privileges”, a framework bug inherits your account.
Notice the spread here. The fresh DSH hole is the new king. The Claude Code fingerprinting below is the original vendor. The injection research after that is the wider ecosystem. One receipt per generation. Whoever is on the throne this quarter, the category keeps producing the same class of incident.
Preview software breaks. Patches land. That is fine. The fashion cycle is what bothers me: launch, stars, plugins, security threads, patches, next harness. If your mental model is “local open source = safe by default”, you will keep getting surprised on a weekly cadence.
2b. The vendor can put fingers on the client
Not every failure is RCE (remote code execution). Some are trust erasures.
In June 2026, Thereallo showed Claude Code steganographically marking requests: tiny character swaps in a date line (apostrophe forms, separators) that depend on signals like API base URL and timezone, including checks tied to Chinese zones and third-party gateways. Visually almost nothing. Functionally a hidden channel in the prompt path.
China’s CNVDB later warned people off certain builds; coverage like The Register’s writeup tracks the mess. Anthropic’s public line has been closer to anti-distillation / monitoring experiment than “we wanted your secrets”, and the mechanism got pulled. Cool. Still:
You were not only trusting a model. You were trusting a local client that could rewrite what leaves your machine without making a fuss about it.
That is a different flavor of “local”.
2c. The model can be talked into betraying you
Prompt injection is boring until the model has hands.
Shape of the attack, not a recipe: you open a repo, a README, a web page, an issue, a mail thread. Somewhere in that text are instructions aimed at the model, not at you. The model is bad at hard-separating “content I am reading” from “orders I should follow”. The orders say some version of inspect the environment, find credential-shaped strings, move them somewhere that looks like normal tooling traffic. Auto-run already removed the human gate.
Named, public research exists. HiddenLayer on README-style hijacks against coding assistants like Cursor. Backslash on AGENTS.md injection in OpenAI Codex CLI, including credential staging behavior in exec-style flows.
One malicious document plus broad privileges is not “the bot said something rude”. It is closer to handing a stranger your badge because the stranger wrote in a font your intern trusts.
2d. No attacker required: the model can just be wrong
This one gets less airtime because there is no villain thread to screenshot. Until there is a receipt with the vendor’s name on it.
Agents do not only fail when someone tricks them. They also fail the ordinary way models fail: wrong path, overconfident cleanup, “helpful” bulk rename, a command that was almost right. Under chat-only products, that is a bad paragraph. Under terminal privilege, a single wrong move can delete the file, empty the folder, or thrash something you cannot casually reconstruct.
You did not get hacked. You got assisted.
Receipt, mid-August 2026. OpenAI’s Codex lead Tibo Sottiaux (@thsottiaux, Aug 19 recap; coverage) posted after “a small number of reports” where GPT-5.6 in Codex took destructive actions outside what the user asked for. Worst pattern: a cleanup step meant for temporary work, after the model had reused a system variable like $HOME as a temp path. A malformed cleanup could then point at the real home directory instead of the scratch folder. Separate cases tried to delete or overwrite a “temporary” path without checking what was already there.
That is not a niche blogger claiming vibe risk. That is the vendor describing production damage, then listing layers they added after the fact: check deletion targets before acting, create fresh temp dirs, stop repurposing env vars, escalate high-risk deletes for review, harden Full access so it is harder to turn on by accident, replay the failures in evals, add RL tasks aimed at this class, filter destructive actions out of training data.
Two things stuck harder than the patch list.
First, the discoverers were real users. “A small number of reports” is a polite way of saying some people’s machines were the lab. A blog post and a model update do not undelete a home directory. If your mental model of shipping agents is “we will catch it in evals first”, this is a receipt that some bugs still ship as pain.
Second, what they found is a pattern class, not a closed case. One wrong cleanup path made the feed because it was legible and catastrophic. The fix set (replays, graders, “we are always improving safety”) is exactly what you write when you expect more edges, not when you think the category is done. Full access still exists. Their own closing advice is still: use a sandbox mode unless you trust the environment and can recover it. That last clause is the product.
You do not need a CVE for this one. You need a backup. And you should assume the next wrong path will not look exactly like $HOME.
If the sales pitch is “it can do anything my shell can do”, then “it can break anything my shell can break” is the same sentence facing the other direction. Pair that with yolo-style auto-approve and you have a power tool with no muscle memory for fear.
3. Supply chain: everything is a plugin
This one deserves its own number. People keep folding it into “security” and then underestimating it.
Local agents get powerful through plugins, skills, MCP servers, bundles, community extensions. A lot of that surface is whoever published on npm or GitHub today. No real review theater for normal humans. Install feels like adding a browser extension. Runtime reality is closer to running someone else’s code inside a process that already has your terminal.
DSH is useful here because it says the quiet part out loud. Repo title: Everything is a Plugin. That is a growth strategy. It is also an attack-surface strategy. If capability is everything-is-a-plugin, the attack surface is everything too.
A separate public thread on early dsh builds describes a rough trust mismatch: third-party plugins can run at boot and rewrite config (approval policy, sandbox mode, credential-related surfaces) before runtime guards are alive, with install paths that look a lot like ordinary package adds: no signature bar, no source allowlist, no “show me the config diff” moment hard enough for normal people.
I don’t need DSH to be uniquely evil for this point to land. The whole category is racing toward “compose your agent from random package gravity”. Capability density goes up. Review capacity does not.
What users feel: I installed a skill.
What the risk looks like: I opened a terminal seat for a stranger.
Until install UX makes that gap impossible to ignore, people will keep clicking through it.
4. Data safety: changed is changed, deleted is deleted
Coding agents grew up next to git.
That matters more than the demos admit.
In a repo, reckless edits are annoying. They are not always fatal. You have history, branches, reflog if you are the kind of person who knows reflog. Git is a safety net for code.
Then the same class of tool gets pointed at everything else: decks, spreadsheets, client folders, notes, finance exports, the random PDF pile on the desktop. Those worlds do not have a green merge button. There is often no backup worth the name. There is definitely no culture of reviewing a diff before the agent “just cleans this up”.
So when an agent rewrites a file or deletes the wrong thing, the failure mode is not “open a PR”. The failure mode is “hope Time Machine was on” or “rewrite the doc from memory”.
The Codex cleanup failures above are the same boundary in a vendor jacket: the tool was optimized to move fast inside a coding loop, and the blast landed on whatever the path resolved to. Git did not save the non-repo files. Patch notes do not either.
Git only ever protected the code. The agent is being invited onto all your files.
A tool designed for a version-controlled world is walking into a non-version-controlled world. That is not a rounding error. That is a product boundary people are casually crossing because the chat UI feels the same.
5. You often cannot even say what happened
The first four points are about damage that can occur.
This one is meaner:
after something feels wrong, you still cannot answer basic questions.
What did it read?
What commands ran?
What left the machine besides the answer in the pane?
Can I replay the minute before it went sideways?
Scrollback is not an audit log. A chat transcript is not forensics. “It said it fixed the sheet” is not evidence.
Serious setups can add isolation, logging, monitoring. Most people installing a trendy harness on a Tuesday night do not. They have a terminal pane and optimism.
So the nightmare is not only that a bad day is possible. It is that a bad day can be illegible. The first four risks can happen. This fifth one is: it happened, and you still don’t know.
The questions people actually type
Since these are the queries that probably brought you here, direct answers:
Is Hermes Agent more secure than OpenClaw?
Structurally, no. Same shape: cloud model brain, shell privileges under your user, community plugin surface. Hermes has had less time to accumulate public CVEs, which is not the same as having fewer holes. And its auto-generated skills feature is a genuinely new attack surface, code the agent writes for itself and then runs, one more layer nobody reviews. hermes claw migrate moves your config over in one command. It moves the risk model over too.
Is DeepSeek Harness safe?
It is days old and early builds already had a publicly documented web control plane with no real auth layer (see the discussion linked above). That is normal for preview software. It is not normal to point preview software at your home directory. If you want to play with dsh, play with it in a VM.
Is OpenClaw dead, or just renamed?
Neither. Attention moved to Hermes, installs did not disappear, and the lineage keeps rebranding (Clawdbot, Moltbot, OpenClaw). This category swaps its favorite brand roughly every six months. Every point in this article survived all of those swaps, which is sort of the whole argument.
The part local actually sold you
Here is the joke, and I don’t think it is clever so much as accurate:
“Local” mostly sold you one feeling: calm. Calm is the one thing the architecture never really paid out.
Your files still go to model APIs in the common setup.
Your privileges are wider than a browser chatbot.
Your plugin story is a gift shop attached to a shell.
Your non-code files often have no undo.
Your post-incident story is vibes.
If you still want local coding agents for real engineering work, that can be rational. Use a VM or a separate OS user. Keep production keys off that profile. Treat README, AGENTS.md, hooks, and plugins like executable code. Do not assume a localhost web UI is “just UI”. Assume anything the agent reads might leave.
Boring on purpose. Boring is the point.
Cloud agents
Looking at local coding agents did not push me into full offline-model life. A lot of my work is not a single repo with a clean merge button. It is long-running projects, messy files, notes that never become tickets, and the habit of wanting a second model to push back on the first.
So I stayed with cloud agents. The distinction that mattered was less the local vs cloud logo fight and more what each product is actually shaped to do. The ones I’ve actually used enough to compare:
Manus is the execution-shaped option. You hand it a concrete job and it comes back with something you can inspect at the door: research pack, draft, one-off build, a bounded automation. That fits well when the unit of work is a deliverable and you care more about the artifact than about the agent remembering who you were three months ago. If your week is mostly discrete tasks with a clear finish line, that orientation is rational.
Notion AI is attached to Notion’s data model. Team pages, company knowledge, the collaborative wiki people already live in. If your team’s source of truth already sits there, running AI against that furniture is the low-friction move. It is also a clear fence. It is optimized for that workspace, not for being a private multi-model workshop for every file that never got cleaned into the wiki.
HaloMate sits closer to a personal cognitive workspace. Projects and files stay put. Personas carry memory. Models work more like engines you can swap when one gets weird. The same room can turn thinking into charts or docs without treating your laptop shell as the sandbox. Less “finish this ticket and leave,” more “this is where ongoing work accumulates.”
None of these is the correct religion. Manus is a strong fit when you want a contractor for a bounded job. Notion AI is a strong fit when the center of gravity is already the team wiki. HaloMate is a strong fit when you want long-running private work to stay coherent without putting a shell agent on your whole machine identity. Pick for the job, not for the tribe.
I ended up going with HaloMate for most of my day-to-day because that is the type of work I actually have: multi-week projects, context I do not want to rebuild every Monday, and second opinions across models without granting a local agent the keys under my user account. (The longer version of how that desk is set up is in the Poe packing list.)
Cloud is not purity either. Prompts still go to providers. Vendors still have bad weeks. Loose connectors can over-share. Pasting secrets into chat is still a self-own. The comparison is about job fit and blast radius, not about finding a saint.
After looking at local agents, the question I care about stopped being “is the icon local”? It became: if this thing is tricked or buggy once, what can it burn?
For non-coding work, I do not want the honest answer to casually include my whole laptop identity. I want memory on purpose, a shorter leash on dangerous actuators, and no marketing story where the word local gets treated like a security control. Local only names where the process sits. Permission decides the damage. A star count from this week is not a review.
The brand will change again in six months. The architecture won’t.