Self-hosting OpenClaw? Six things to check before it costs you money or your keys

Spending caps, exposed gateways, CVEs, backups: what to fix on your OpenClaw or Hermes Agent server before it bites. Most people install a personal AI agent in an evening. Most of the pain shows up a week later.

I like the idea behind OpenClaw and Hermes Agent: your own assistant, on your own server, talking to you in Telegram. No SaaS in the middle, your data stays with you.

The problem is that "it runs" and "it's safe to leave running" are two different things. Here is the short list I go through on every install. None of it is exotic. All of it is something people have already paid for.

1. Put a hard spending cap on the API key. Not in the agent, on the key.

OpenClaw has no built-in hard spending limit. Its own docs say the usage numbers it shows are estimates: "Partial totals are not complete billing totals." (docs)

What that looks like in real life:

• $18.75 overnight on heartbeat checks asking "is it morning yet?" (Notebookcheck)
• $250 in one day because the context quietly grew until every call was heavy (Indie Hackers)

The only limit that actually stops the bleeding is the one on the provider side: a separate key with its own monthly cap (OpenRouter, Anthropic console, whatever you use). Give the agent that key and nothing else. Check how often heartbeat runs and on which model while you're at it.

2. Make sure the gateway is not on the internet

In February 2026 SecurityScorecard found 40,214 exposed OpenClaw instances, 63% of them vulnerable and 12,812 exploitable via remote code execution (Infosecurity Magazine). The main reason was simple: the gateway listened on all interfaces and the dashboard had no auth.

The current docs are clear about it: "never expose the Gateway unauthenticated on 0.0.0.0" and "prefer Tailscale Serve over LAN binds" (docs). From outside the server, scan your own IP. If you see port 18789 or the dashboard, fix that first.

3. Pin a version that is past the known CVEs

Two that matter:

• CVE-2026–25253, one-click RCE through the Control UI, CVSS 8.8, fixed in 2026.1.29 (The Hacker News)
• CVE-2026–33579, privilege escalation via pairing, CVSS 9.4–9.9, fixed in 2026.3.28 (Wiz)

Pinning matters because updates are the other problem. One GitHub issue is literally called "Your Updates Are Killing Your Product", and people in it roll back to a known stable build (#65302). So: pin a version you tested, and update on purpose, not automatically.

4. Take a snapshot before every update, and test the restore once

A backup you never restored is a hope, not a backup. Snapshot the server before you touch the version. Then actually roll back once, on a quiet evening, so you know it works before you need it.

5. Treat skills like random code from the internet. Because they are.

Snyk looked at the skills marketplace and found 534 skills with critical findings and 76 confirmed malicious ones (Snyk). Infostealers already go after openclaw.json with the gateway token and device.json with private keys (The Hacker News). Install only what you read, and keep the agent's user away from anything it doesn't need.

6. Know who else has access

If someone helped you set it up, ask a boring question: is their SSH key still on the server? Temporary access should be removed when the job is done, and you should be able to check that yourself.

Running Hermes Agent instead?

Most of this applies one to one. Hermes has no built-in hard spending cap either, and its own security docs recommend running the gateway in an isolated backend or on a separate machine and never allowing all users in production (Hermes docs). Same six checks, different config files.

Why I'm writing this

I learned point 1 the expensive way. I run agents for my own side projects, and one night I left one working on its own. In the morning it had blown straight through my limit. Nothing was broken, it was just busy all night.

After that I set one up for a friend's team, and later deployed agents from several different vendors for one reason: to pentest them. That's where the rest of this list comes from. Getting an agent to run is easy. Getting it to a state where you can stop worrying about it is a separate job, and almost everyone skips it.

So I'm turning this checklist into a service, and I'm starting right now. I install the agent on your own VPS, go through these six checks plus the rest of the 14 I do, and you get a report with proof for each one. It's new, so the first 20 installs go at a launch price. If you want to be one of them: getownagent.com

If you'd rather do it yourself, that's fine too. Just do number 1 tonight.