Running a self-hosted AI agent on a VPS

Part of the self-hosted AI series. See the complete series for the rest.

An AI agent is more than a chatbot. You message it from Telegram, Slack or another chat app, and it can do things for you: search the web, read and write files, run commands, summarise your inbox or carry out multi-step tasks. Self-hosted agents such as OpenClaw and Hermes Agent became some of the most talked-about open source projects of 2026, and a VPS is a natural home for them, because it runs all day and keeps the agent away from your own computer.

This guide explains what these agents are, which plan size they need, how to set one up, and above all how to run one safely. That last part matters more than usual. An agent that can run commands and use your accounts is powerful in the wrong hands too, and the most popular agent has had a rocky security history. Projects in this space change monthly, so treat names and details here as a snapshot from late 2026 and check each project's own documentation.

What is in this guide

• A few words you will see
• What a self-hosted agent does
• The main options
• What size VPS you need
• What it really costs
• Why security comes first
• Ten rules for running an agent safely
• Setting one up, step by step
• Good first jobs, and jobs to avoid
• Troubleshooting
• Limits
• When to step up

A few words you will see

Term	What it means
Agent	An AI program that plans and carries out tasks using tools, not just answers questions.
Model	The AI that does the thinking. Usually a paid service reached through an API, or a smaller model run on your own server.
API key	A secret that lets the agent use a model service, and that is billed to your account.
Tools	What the agent is allowed to do, such as browse, run commands or read email.
Skills or plugins	Add-ons that give the agent new abilities. Often published by other people.
Gateway	The part of some agents that listens for connections from apps and the control panel.
Prompt injection	Hidden instructions in a web page, email or document that trick an AI into doing something you did not ask for.
Tokens	The units model services bill by. Longer tasks use more.

What a self-hosted agent does

Most agents work the same way. You send a message in a chat app. The agent sends it to a model along with a list of the tools it may use. The model decides on steps, the agent runs them, sends the results back to the model, and repeats until the task is done. Then it replies to you.

Typical abilities include:

• Chatting through Telegram, Slack, Discord, WhatsApp, Signal or email.
• Searching the web and summarising what it finds.
• Reading and writing files in a workspace folder.
• Running commands or code, ideally in a sandbox.
• Remembering things between conversations.
• Running scheduled jobs, such as a daily summary.

Self-hosting means the agent software, its memory and its files live on your server. The thinking is usually done by a model service you connect with an API key, unless you also run a local model, which needs a much bigger server.

The main options

A snapshot from late 2026. All of these are under active development.

Agent	What it is	Worth knowing
OpenClaw	The most popular open source personal agent, MIT licensed, previously known as Clawdbot and Moltbot. Talks through many chat apps, with a large registry of add-on skills	Very capable, very widely used, and with a serious security history. See why security comes first
Hermes Agent	A lighter personal agent from Nous Research, MIT licensed, with shared memory and skills it writes for itself	Connects outward to your chat apps, so it needs no open port. Newer and less tested than OpenClaw
Agent Zero	A general agent framework that runs in a Docker container and can start helper agents	Its standard setup publishes a web panel on every address. Bind it to 127.0.0.1
OpenHands	An agent for software work: planning, writing and testing code	Has real access to the project folders you give it. Best on a disposable server
n8n	Not an agent as such, but a workflow tool with AI steps	More predictable, because you design every step. See automating with n8n

For a first agent, Hermes Agent is the gentler start, because it needs no open port and is lighter. OpenClaw has the most features and community, but needs the most care.

What size VPS you need

The agent itself is fairly light when a model service does the thinking. Memory needs rise sharply if the agent drives a web browser, or if you run a model on the server.

Setup	Rough starting plan
A light agent such as Hermes Agent, using a model service	2 GB, with 4 GB more comfortable
OpenClaw, using a model service	RackNerd's AI VPS page lists 8 GB as the minimum for its one-click OpenClaw install. The project itself may run on less, but browser tasks add a lot
Any agent that drives a web browser	4 GB or more, as each browser uses hundreds of MB
An agent plus a small local model	8 GB or more, and expect it to be slow on CPU. See self-hosted AI on a 6 GB or 8 GB VPS

These are rough figures, and requirements change between versions. Check the project's current documentation, and watch free -h once it runs. Swap helps with brief peaks, but it is a safety net, not extra RAM.

Give the agent its own VPS rather than adding it to a server that holds your website, backups or other important data. That one choice limits the damage if something goes wrong.

What it really costs

• The server, shown live in the plan lists on this page.
• Model usage. Agents loop: one request can turn into many model calls. A task that goes in circles can use far more than you expect. Set a hard monthly spending limit in your model provider's account before you start.
• Your time, for setup, updates and checking what the agent did.

Self-hosted AI vs paying for an API explains how model costs work.

Why security comes first

An agent has the keys to whatever you connect it to: a shell on the server, your chat accounts, your API keys, sometimes your email or calendar. Several things have gone wrong in 2026, mostly with OpenClaw because it is the most widely used:

• Exposed control panels. Security researchers found tens of thousands of OpenClaw installs reachable from the internet, some leaking credentials and chat histories. Early versions trusted local connections without a password, and a misconfigured proxy could make outside traffic look local.
• Serious software flaws. Several vulnerabilities were found and fixed, including one where a malicious web page could take over a running agent. Out-of-date installs remain at risk.
• Malicious skills. Security firms reported hundreds of skills in OpenClaw's public registry containing malware, including password stealers hidden in fake setup steps.
• Prompt injection. Text in a web page, email or document can instruct the agent to leak secrets or run commands. With long-term memory, a planted instruction can wait and trigger later. There is no complete fix for this yet.
• Plain-text secrets. API keys and chat tokens are often stored in config files that the agent itself can read.

The projects have improved their defaults since, and Hermes Agent's design avoids some of these problems. But the lesson applies to every agent: treat an agent as an untrusted program with your keys, and limit what it can reach.

Ten rules for running an agent safely

1. Give it its own VPS. Nothing else important on that server, and no saved logins to your other servers.
2. Run it as a normal user, never as root, and do not add that user to the docker group, which equals root.
3. Keep its control panel private. Bind any web panel or gateway to 127.0.0.1 and reach it through an SSH tunnel or VPN. Never open it to the internet.
4. Turn on its own authentication, such as a gateway token or password, even when it is private.
5. Only allow your own chat account. Most agents can be limited to specific user IDs. Do this, or anyone who finds the bot can command it.
6. Use separate, limited API keys with a spending cap, created just for the agent. Rotate them if anything looks wrong.
7. Start with few tools. Web search and a workspace folder first. Add shell access, email or calendar only when you need them, and prefer read-only access where offered.
8. Vet every skill or plugin. Read its code and check its publisher. Treat a skill like installing a stranger's program, because that is what it is.
9. Update promptly. Agent projects ship security fixes often. Check for updates weekly.
10. Review what it does. Read its logs and memory now and then, and check it has not changed files or settings you did not expect. Read and test anything it writes before you rely on it.

The wider basics are in a beginner's guide to securing your VPS and keeping self-hosted AI safe and private.

Setting one up, step by step

Exact commands differ by project and change often, so follow the project's own install documentation for the details. These steps wrap around it.

1. Prepare a dedicated server

Start from a fresh VPS. Secure it first: updates, SSH keys, no password login and a firewall. Your first hour on a new RackNerd VPS walks through it. Then make sure only SSH is open:

sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw enable

An agent that connects out to your chat apps, as most do, needs no other open port.

2. Create a user for the agent

sudo adduser --disabled-password --gecos "" agent

Run the agent as this user. Do not give it sudo.

3. Choose how to install it

Method	Notes
RackNerd's one-click installer	RackNerd's control panel offers one-click installs for several agents and AI tools. It erases the VPS and reinstalls it, so only use it on a fresh server. Afterwards, still apply the rules above, and check what is listening
The project's Docker setup	Keeps the agent in a container. Publish any ports on 127.0.0.1 only. See installing and using Docker on a VPS
The project's own installer	Some projects offer a one-line install script. Download it, read it, and only then run it. Never pipe a script you have not read straight into your shell

4. Check what is listening

sudo ss -tulpn

Any port belonging to the agent should show 127.0.0.1, not 0.0.0.0 or *. If you use Docker, check this even if UFW looks closed, because Docker's published ports can bypass UFW. To open a private panel from your own computer, use an SSH tunnel, replacing PORT with the panel's port from the project's documentation:

ssh -L PORT:127.0.0.1:PORT alex@SERVER_IP

5. Connect a model, with limits

Create a new API key just for the agent in your model provider's dashboard, set a monthly spending limit, and give the key to the agent through its setup. Keep any env or config file holding keys readable only by the agent user:

sudo chmod 600 /home/agent/PATH_TO_CONFIG_FILE

6. Connect one chat app, locked to you

Start with one channel, such as a Telegram bot. Follow the agent's instructions to create the bot, then set the agent to accept messages only from your own user ID. Test that a message from another account is ignored.

7. Start small, then add tools

Begin with harmless tasks, such as web searches and summaries. Watch the logs and your model spending for a few days. Add more tools one at a time, only when you need them.

8. Keep it maintained

• Update the agent weekly, after reading release notes for security fixes.
• Back up its config and memory folder off the server. See using a storage VPS for backups.
• Rotate its API keys every few months, and straight away if you suspect anything.
• Review its memory and recent actions now and then for anything you did not ask for.

Good first jobs, and jobs to avoid

Good first jobs	Avoid, at least at first
Research a topic and send a summary	Full access to your main email account
A daily digest of news or feeds you choose	Sending messages or posts on your behalf without approval
Draft notes, lists or plans in its workspace folder	Access to banking, payments or trading
Reminders and simple scheduled checks	Shell access on a server that holds anything important
Summarise documents you upload to it	Installing skills you have not read

A useful rule: let the agent read and draft freely, but make it ask before it sends, deletes, buys or changes anything.

Troubleshooting

Symptom	Likely cause	Fix
Agent does not answer in the chat app	Bot token wrong, agent not running, or your user ID not allowed	Check the agent's logs and its allowed users setting
Agent crashes or is killed	Out of memory, often from browser tasks	Check free -h and dmesg, limit browser use, or step up a size
Model bills higher than expected	Long tasks or loops making many calls	Lower the spending limit, shorten tasks, and check logs for repeats
Control panel reachable from outside	Port published on all addresses	Bind it to 127.0.0.1 and restart, then check with ss -tulpn
Agent did something you did not ask	Prompt injection from content it read, or a bad skill	Stop it, rotate its keys, review its memory and skills. See what to do if your VPS is hacked if anything looks compromised
Setup command not found	Install method changed in a newer version	Follow the project's current documentation

Limits

• Agents make mistakes. They misread tasks, invent facts and get stuck in loops. Check their work.
• Prompt injection has no full fix. Limiting tools and access is the main defence.
• Projects move fast. Names, install steps and defaults change, sometimes monthly. This guide describes late 2026.
• Model terms and licences apply. Check your model provider's terms, and each agent's and skill's licence.
• Rules still apply. You are responsible for what your agent does from your server under RackNerd's acceptable use policy, including web scraping and messages it sends. Unmetered does not mean unlimited, and heavy browser automation can hit fair-use limits.
• A hosted assistant may suit you better. If you only want to chat with an AI, a hosted app is simpler and carries less risk. Self-hosting an agent makes sense when you want it running all day, with your own data and tools.

When to step up

Start with 4 GB for a light agent. Step up to 8 GB for OpenClaw, browser automation or several agents, and beyond that if you want a local model doing the thinking. For larger local models, a dedicated server is the next step. See self-hosted AI on a dedicated server. If you are new to self-hosted AI, self-hosting AI explained for beginners is a good place to start.

To compare what is available now, start with the cheapest RackNerd VPS guide and check the sales page.