When we first wrote this guide in May, all three major agent frameworks pointed Windows users at WSL2. That's no longer true. Hermes Agent now installs natively on Windows, and Microsoft shipped a new way to contain agents on October 7. Here's which agents still want WSL2, the unified setup for the ones that do, the 4 Windows-specific traps that break your agent, and the options that skip WSL2 entirely.
A developer on the Blink blog summarized it perfectly: "You just read through Docker setup, WSL2 configuration, systemd, Node.js version management, firewall rules, CVE patches, security hardening, and three different auto-start strategies. None of that is the agent. All of it is infrastructure."
That's the Windows AI agent experience in one paragraph.
OpenClaw's official docs say: "WSL2 is recommended. Native Windows might be trickier." Claude Code requires a Unix terminal. On Windows, that means WSL2. Hermes is the one that changed: its docs now call WSL "an alternative, not a requirement", and there are four native ways to install it.
Updated October 13, 2026. We rewrote the Hermes sections (native install, desktop app, Microsoft Store), added Microsoft Execution Containers (MXC), and added a table of every Windows route per agent. The WSL2 setup and the four traps below are unchanged, because they still apply to anyone who runs agents inside WSL2.
Windows routes per agent, at a glance
| Agent | Native Windows | WSL2 | MXC (Microsoft Execution Containers) | Store app or installer |
|---|---|---|---|---|
| OpenClaw | Possible, but the docs warn it "might be trickier" | Recommended by the OpenClaw docs | Integrated (GA October 7, 2026) | Not covered here |
| Hermes Agent | Yes: PowerShell one-liner, Windows 10 and 11, no admin | Supported, now "an alternative, not a requirement" | "Coming later" per Microsoft | Desktop MSIX (Windows 11 22H2+), Microsoft Store version, Hermes-Setup.exe |
| Claude Code | Needs a Unix terminal, so WSL2 on Windows | Yes | "Coming later" per Microsoft | Not covered here (the Claude desktop app is a separate product) |
Read across a row before you install anything. If Hermes is the only agent you want, you may not need WSL2 at all. If you want OpenClaw or Claude Code too, WSL2 is still the path that runs all three side by side.
Here's the unified WSL2 setup, then native Hermes, then MXC, then the four traps that will waste your afternoon if you don't know about them, and finally the alternative that makes all of this unnecessary.
The WSL2 setup (10 minutes, one command to start)
Step 1: Enable WSL2. Open PowerShell as Administrator. Run:
wsl --install
This enables WSL2 and installs Ubuntu 24.04. Restart when prompted. After restart, Ubuntu launches automatically. Create a Linux username and password (separate from your Windows login).
Step 2: Verify WSL version. In PowerShell:
wsl --list --verbose
You should see Ubuntu with VERSION 2. If it shows VERSION 1, upgrade: wsl --set-version Ubuntu 2.
Step 3: Install Node.js 22. Inside Ubuntu (open from Start Menu):
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs
Verify: node --version (should show v22.x).
Step 4: Install your framework. This is where the paths diverge.
For OpenClaw: npm install -g openclaw@latest --allow-scripts=openclaw then openclaw onboard --install-daemon (the commands in OpenClaw's README as of 2026.10.2; clawdbot is the old January package name)
For Hermes: curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash
For Claude Code: npm install -g @anthropic-ai/claude-code then set your API key
The unified WSL2 advantage: One Linux environment runs all three. Install OpenClaw for always-on messaging, Hermes for goal-tracked automation, and Claude Code for coding. They share the same Ubuntu, the same Node.js, the same filesystem. No conflicts.
Hermes without WSL2: the native Windows routes
If Hermes is your agent, you can skip everything above. WSL2 is no longer required. The Hermes docs now describe WSL as "an alternative, not a requirement", and there are four native routes.
Route 1: the PowerShell installer (Windows 10 and 11). Open a normal PowerShell window. You don't need admin rights. Run:
iex (irm https://hermes-agent.nousresearch.com/install.ps1)
It installs Hermes to %LOCALAPPDATA%\hermes, under your user account, so it doesn't touch system folders.
Route 2: the desktop app (MSIX). Hermes ships a desktop app for Windows, installed through an .appinstaller file. This route is Windows 11 22H2 or newer only. The desktop app is where Bot Mode, the Connectors page and the update switch under Settings > About > Updates live.
Route 3: the Microsoft Store. There is also a Microsoft Store version, handy on machines where the Store is your usual way to install software.
Route 4: Hermes-Setup.exe. A bootstrap installer for people who want a classic download-and-run setup.
A note on versions: v0.21.7 (release notes dated October 11, 2026) is the first desktop, Store and installer build since v0.21.5. v0.21.6 (October 8) was tag, GitHub release and Docker only, so the Windows desktop app jumped straight from v0.21.5 to v0.21.7. Also new in v0.21.7: source installs update to the latest tagged release instead of every commit on main. hermes update --set-channel main switches back if you want the bleeding edge.
When WSL2 still makes sense for Hermes
Native is now the shorter path, but WSL2 hasn't become pointless. Pick WSL2 for Hermes when:
- You also run OpenClaw or Claude Code. One Ubuntu for all three is still simpler than two environments with two copies of your keys.
- You want the gateway to auto-start as a Linux service. Under WSL2 that means systemd, covered in Trap 4.
- Your other tooling is Linux-first. Shell scripts, cron habits and Docker workflows carry over unchanged.
Pick native when Hermes is your only agent, you mostly use the desktop app, or WSL2 isn't allowed on your machine. Either way, the always-on caveat at the end of this guide still applies: a laptop that sleeps takes the agent down with it.
MXC: Microsoft's new way to contain agents on Windows
On October 7, 2026, Microsoft made Microsoft Execution Containers (MXC) generally available. MXC is policy-driven containment for AI agents: instead of giving an agent your whole user account, it runs the agent inside a container with rules about what it can touch.
MXC has several backends:
| Backend | Where it runs | Status |
|---|---|---|
| Process container | Windows 11, macOS, Linux | GA |
| Session container | Windows 11 only | GA |
| WSL container | Windows 11 only | GA |
| MicroVM | Not specified | Experimental |
Windows 365 support is also generally available. Intune and Entra/Agent 365 controls are "coming soon", so admins can't manage MXC policy from those consoles yet.
Which agents work with it today. Microsoft lists GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI as already integrated, plus NVIDIA OpenShell. Anthropic Claude Code and Hermes Agent are on the "coming later" list, along with Box, Egnyte, Manus, Perplexity, Raycast, Simular and Heidi Health.
What this means for the three agents in this guide:
- OpenClaw: MXC is a real option now. If you run OpenClaw on Windows 11 and worry about what a skill can reach, containment is worth a look.
- Hermes and Claude Code: not yet. Use WSL2 (or native Hermes) today, and check Microsoft's list before you plan around MXC.
- Mixed setups: the WSL container backend means MXC and WSL2 aren't either/or. It is Windows 11 only, so Windows 10 machines stay on plain WSL2.
MXC doesn't change the traps below. If your agent ends up running in WSL2, with or without a container around it, filesystem speed, RAM, networking and systemd still behave the way they always did.
The 4 Windows-specific traps (read this before debugging for 3 hours)
Trap 1: Cross-filesystem I/O is 10-20x slower
What happens: You store your agent data on your Windows drive (accessible inside WSL as /mnt/c/Users/...). Every file read and write is 10-20x slower than native Linux filesystem access. Your agent feels sluggish. Memory file access crawls.
The fix: Always work in your WSL home directory (/home/yourusername/). Never store agent data on /mnt/c/. The speed difference is dramatic and invisible unless you know to look for it.
For the general OpenClaw troubleshooting guide, our guide covers the broader diagnosis including WSL-specific issues.
Trap 2: WSL IP changes on every restart
What happens: WSL2 uses a virtual network adapter. The IP address changes after every Windows restart. If you set up port forwarding to access your agent from your phone, the forwarding rule breaks after reboot.
The fix: Create a PowerShell script that detects the current WSL IP and updates the forwarding rule. Run it at startup. Or use Tailscale inside WSL2 for persistent access without port forwarding.
Trap 3: WSL2 eats your RAM
What happens: By default, WSL2 can use up to 80% of your system RAM. Your Windows machine becomes sluggish while your agent runs. Background tasks slow to a crawl.
The fix: Create .wslconfig in C:\Users\YourName\:
[wsl2]
memory=4GB
processors=2
This limits WSL2 to 4GB RAM and 2 CPU cores. Enough for one agent. Adjust based on your hardware.
Trap 4: systemd isn't always enabled
What happens: OpenClaw's daemon mode (--install-daemon) and Hermes's gateway need systemd to auto-start. Some older WSL2 versions don't enable systemd by default.
The fix: Add [boot] systemd=true to /etc/wsl.conf inside Ubuntu. Restart WSL: wsl --shutdown then reopen.
If setting up WSL2, configuring systemd, managing RAM limits, refreshing port forwarding on every reboot, and debugging cross-filesystem performance sounds like more Windows infrastructure work than building agent workflows, BetterClaw eliminates the WSL2 requirement entirely. No WSL2. No Linux kernel. No PowerShell scripts. The agent runs in the cloud. You access it from any browser on any operating system. Free tier with 1 agent and BYOK. $49/month for Pro. 60-second deploy.
Which framework to install first (the decision)
OpenClaw if you want a messaging agent with 50+ channel support and the largest skill ecosystem (230K+ stars). Self-hosted. You manage updates, security (540+ CVEs), and infrastructure.
Hermes if you want goal tracking, multi-agent Kanban, and self-maintaining skills. Fewer channels (20) but more durable task completion. Reportedly more stable than OpenClaw. It's also the only one of the three that installs natively on Windows without WSL2.
Claude Code if you want a coding agent in your terminal. Different category entirely (coding vs life automation). Most developers run Claude Code alongside one of the other two.
All three coexist in the same WSL2 Ubuntu without conflicts. OpenClaw uses npm. Hermes uses Python (uv). Claude Code uses npm with a separate global package. No collisions. If you'd rather run Hermes natively, it sits happily alongside a WSL2 Ubuntu that holds the other two.
For the detailed comparison of OpenClaw vs Claude Code, our comparison covers the category distinction.
The honest question (do you actually need WSL2?)
Here's the take no one else gives you.
WSL2 is a workaround. OpenClaw and Claude Code are built for Linux and macOS first. Your machine runs Windows. WSL2 bridges the gap. Hermes now has native Windows builds, and MXC gives Windows its own containment layer, but neither changes the bigger point below. But the gap exists because you're running a server workload on a desktop operating system.
The always-on agent use case (gateway running 24/7, responding to messages while you sleep) doesn't belong on a Windows laptop with WSL2. It belongs on a server. Your laptop sleeps. Your agent stops. Your gateway loses its websocket connections. Your cron jobs miss their schedules.
WSL2 is excellent for development and testing. It's fragile for production. The RAM limits, the IP changes, the systemd quirks, the cross-filesystem penalty. All of these exist because WSL2 is a compatibility layer, not a native runtime.
If you want a production always-on agent, you have three options: a VPS ($5-10/month, you manage everything), dedicated hardware ($80-700, always on at home), or a managed platform ($0-19/month, no infrastructure). If you're leaning toward your own box, our OpenClaw hardware guide compares mini PC, Mac Mini, and VPS for always-on agents.
If the managed path interests you, give BetterClaw a try. Free tier with 1 agent and BYOK. $49/month for Pro. No WSL2. No Linux. No Windows infrastructure. The agent runs on our servers. You interact through your chat apps. The operating system on your laptop doesn't matter.
Frequently Asked Questions
Do I need WSL2 to run AI agents on Windows?
It depends on the agent. For OpenClaw, WSL2 is the recommended path; OpenClaw's docs call it "recommended for best performance." Claude Code requires a Unix terminal (WSL2 on Windows). Hermes Agent no longer needs WSL2: it installs natively on Windows 10 and 11 with a PowerShell one-liner, and there's a desktop app (Windows 11 22H2+), a Microsoft Store version and Hermes-Setup.exe. Its docs call WSL "an alternative, not a requirement". BetterClaw doesn't need WSL2 at all (cloud-based).
Does Hermes Agent need WSL2 on Windows?
No. Run iex (irm https://hermes-agent.nousresearch.com/install.ps1) in a normal PowerShell window (no admin needed) and it installs to %LOCALAPPDATA%\hermes. You can also use the desktop MSIX on Windows 11 22H2 or newer, the Microsoft Store version, or Hermes-Setup.exe. WSL2 still works and is a good choice if you also run OpenClaw or Claude Code in the same Ubuntu.
What is MXC (Microsoft Execution Containers)?
MXC is Microsoft's policy-driven containment for AI agents, generally available since October 7, 2026. It offers process containers (Windows 11, macOS, Linux), session and WSL containers (Windows 11 only), and an experimental MicroVM backend. OpenClaw, GitHub Copilot, OpenAI Codex, Replit, LM Studio and Unsloth AI are already integrated. Claude Code and Hermes Agent are listed as "coming later".
How long does WSL2 setup take for AI agents?
The WSL2 installation itself takes 5-10 minutes (one command + restart + Node.js install). Installing an agent framework adds 2-5 minutes. The traps (filesystem performance, RAM limits, systemd, port forwarding) can add hours of debugging if you don't know about them. Total with traps avoided: 15-20 minutes. Total without knowing the traps: potentially an afternoon.
Can I run OpenClaw and Hermes in the same WSL2 instance?
Yes. They use different runtimes (OpenClaw uses Node.js, Hermes uses Python/uv) and don't conflict. You can also run Hermes natively on Windows and keep OpenClaw in WSL2. Claude Code also coexists as a separate npm global package. Many power users run all three in the same Ubuntu WSL2 environment for different purposes: OpenClaw for messaging, Hermes for goal-tracked automation, Claude Code for coding.
Does WSL2 work for always-on agents?
For testing: yes. For production: not recommended. WSL2 shuts down when Windows sleeps. The IP address changes on restart. RAM is shared with Windows. A VPS ($5-10/month), dedicated hardware (Pi or mini PC), or a managed platform like BetterClaw ($0-19/month) is more reliable for 24/7 always-on agents.
What's the alternative to WSL2 for Windows AI agent users?
BetterClaw runs entirely in the cloud. No WSL2, no Linux, no local installation. The agent runs on managed infrastructure accessible from any browser. Free tier with 1 agent and BYOK. $49/month for Pro. For users who want self-hosted without WSL2, Hermes now runs natively, OpenClaw can run inside Microsoft's MXC containers on Windows 11, and Docker Desktop on Windows is an option but adds its own complexity (Hyper-V, container management, port mapping).
