Hermes Agent is safe enough for a small business once it is set up for one, and not before. Its makers describe it as a personal agent for one trusted person. It becomes safe for a team once it has its own computer, a short list of people who can give it work, no door to the open internet, and someone who installs updates every week.
Its built-in safety checks are real, and they catch an honest agent's mistakes. Its own security policy is just as clear that they will not stop someone who sets out to trick it. That one fact shapes most of the setup decisions below.
| Area | What Hermes Agent does out of the box | What you still have to decide |
|---|---|---|
| Who can give it work | Refuses everyone in a chat app until you add them to its allowed list, or approve them with a one-time pairing code | Who goes on the list. Everyone on it gets the same powers |
| Risky commands | Pauses commands that look dangerous. A second AI lets low-risk ones through, refuses clearly dangerous ones, and asks a person about the rest | Whether the check stays on. One setting turns it off for everything |
| Nobody answers | After five minutes without a reply, the answer is no. Scheduled jobs skip the risky step instead of waiting | Where approval requests go when you are away from your desk |
| The computer it runs on | Runs commands right on that machine, with the access of the account that installed it | Its own computer, or a walled-off space on one |
| Saved passwords | Blocks edits to the computer's key password files and keeps its own service passwords away from the helper programs it starts | Which logins it holds at all |
| Add-ons | Scans them for suspicious patterns before they go in | Who reads each add-on first. Add-ons run with the agent's full access |
| Fixes | Ships them often: 21 releases from August 1 to October 28, 2026 | Who installs them, and how soon |
Is Hermes Agent safe to use in a small business?
Yes, if four things are true: it runs on a machine that holds nothing else of yours, only people who should share the same powers can give it work, nothing it reads from strangers can reach a step that sends or pays, and a named person installs updates every week. Without those, it is a capable assistant holding your logins with nobody minding it.
The project says this about itself. Its security policy, read on October 29, 2026, opens its trust model with one line: "Hermes Agent is a single-tenant personal agent." In plain terms, it is built for one person, and it trusts everyone allowed to talk to it equally. A business can use it well. A business has to do the extra setup for more than one person, though, and the software will not do that setup for you.
Hermes Agent is also a serious project. It is free under the MIT license, built in public by Nous Research since July 2025, and more than 258,000 people had starred it on its public project page by October 29, 2026. The risk is in how each copy gets set up and looked after.
What does Hermes Agent protect by default?
Hermes Agent protects more by default than most people expect. Its security documentation lists eight layers of protection. For an owner, four of them matter most: who can talk to it, what it may run without asking, what happens when nobody answers, and which files it may never change.
Who can talk to it is the strongest default. When no allowed list is set, Hermes refuses every person who messages it in a chat app. You add people by name, or let a newcomer request a one-time code that you approve. That code expires after an hour, and five wrong tries shut the door for an hour.
Risky commands come next. Before it runs anything that looks destructive, such as deleting a folder, wiping a drive, or rewriting system settings, it pauses. In its default mode, a second AI rates the risk, lets clearly harmless ones through, refuses clearly dangerous ones, and sends the unclear ones to a person. A few, such as erasing the whole computer, are blocked every time, even with the check switched off.
When nobody is around, it says no. A request for approval that waits five minutes is treated as a refusal. A scheduled job that reaches a risky step is refused and has to find another way. Its guide for running Hermes on a personal or work machine puts the timeout this way: "Unanswered prompts are denied (fail-closed)."
All of these are settings, though. The documentation is open about the one that turns the approval check off completely, and it calls that YOLO mode. Whoever sets up your copy decides what stays on. Ask to see it, the same way you would ask to see the alarm code list for your building.
What do Hermes's makers say the safety checks cannot do?
They say the checks help but cannot protect you on their own. The security policy groups the approval check, the scrubbing of passwords from what it displays, and the add-on scanner together, and says of them: "They are useful. They are not boundaries." The only real wall, the policy says, is the computer's own operating system.
The approval check works from a list of risky patterns, and there are endless ways to phrase a command. The policy says it catches an honest agent's mistakes, but an agent being steered on purpose can get around it.
The steering usually comes through something the agent reads. Say you ask it to compare three suppliers, and one supplier's web page carries a hidden line telling AI assistants to send your price list to an outside address. That is an example we made up, but it is the shape of the risk. Hermes's policy says that tricking the AI with planted text is not, on its own, counted as a security flaw in Hermes. That is honest. It also means no update will fully close that door, so your setup has to.
The policy draws a clear line here. If the agent reads things strangers can write, like your inbox, the open web, a group chat, or an outside add-on, the project says to run the whole agent inside a sealed-off space on its computer. Running it straight on a normal machine with those inputs is, in its words, "outside the supported security posture." The access side of that, meaning which systems to connect at all, is covered in what access an AI agent should have to your business systems.
How many security flaws has Hermes Agent had?
As of October 29, 2026, the U.S. National Vulnerability Database lists 45 public records of security flaws in Hermes Agent, published between April 27 and October 21, 2026. None is rated critical. By the severity scale those records carry, 11 are rated high, 31 medium, and 2 low, and the newest has no rating yet.
That is about eight new records a month since May. Thirty-nine of them came through one outside database, VulDB. Six came from the security firm VulnCheck and one from CERT/CC, the coordination center at Carnegie Mellon. Here are four of them in plain words, each one checked against the release it was fixed in:
| Made public | What it allowed | Rating | First release with the fix |
|---|---|---|---|
| June 17, 2026 | A malicious website could slip past the check that keeps outside pages away from the agent's built-in control screen, then send it commands or read its output | High | 0.16.0, June 5 |
| August 28, 2026 | Instructions planted in a message the agent read could get it to overwrite its own stored logins | Medium | 0.17.0, June 19 |
| August 28, 2026 | An add-on in its built-in catalog pointed to an outside source that could change, so anyone who took over that source could run code on every computer that installed it | High | 0.19.0, July 20 |
| September 3, 2026 | Opening a booby-trapped code folder and sending any message could run an attacker's command and expose the passwords the agent uses for its AI service | High | 0.21.1, September 7 |
Three of those four went public only after a fixed version was already out. In the fourth, the fix was written on September 2, the public record appeared on September 3, and the first release with the fix shipped on September 7. Anyone running an older copy had four days where the flaw was public and no ready update existed.
Fixes come out quickly. Hermes put out 21 releases from August 1 to October 28, 2026, which is one about every four days. A copy in your office only gets those fixes when someone installs them, so a monthly update habit leaves you weeks behind.
Is Hermes Agent legit, or could it be stealing your data?
Hermes Agent is legitimate software. An outside reviewer read the whole project, version 0.8.0, before installing it and posted the results on its public issue tracker on April 11, 2026. The review found "No malware, backdoors, or data exfiltration" and "No telemetry or phone-home behavior," and found its passwords went only to the services they were meant for.
The same reviewer also wrote that "the default security posture is ALLOW-ALL." That review is of an April version, and some defaults have changed since then. A few of its points still apply today. Fencing its file changes into one folder is still something you switch on yourself, and so is the undo feature that saves a copy before risky changes.
Your data does leave the building in one expected way. Unless you run the AI on your own hardware, whatever the agent reads goes to the AI company it uses, because that is where the thinking happens. That company's data terms apply to your files and messages, so pick the AI service with the same care you would pick a payroll vendor.
Can Hermes Agent control your computer?
Yes, Hermes Agent can control the computer it is installed on. By default it runs commands right on that machine, and it can reach whatever that computer account can reach, apart from a short list of protected files. Install it on your own laptop and it works inside your documents and your saved logins. That is the reason not to put it there.
Hermes's own guide for a personal or work machine suggests four steps for anywhere with business data or other people's files: have it ask before every flagged command, add a list of commands it must never run, fence its file changes into one folder, and move its command running off the main machine. The guide is clear about the limit of the first two. They are, in its words, "a guardrail against an honest-but-wrong agent," not a wall against an attacker.
A Hermes safety check before it gets a real login
Give this to whoever is setting it up, whether that is your own staff, a contractor, or a vendor. Ask them to show you each answer on screen rather than describe it.
| # | Ask | Where they look | A good answer |
|---|---|---|---|
| 1 | Who can give it work? | The allowed list for each chat app it is connected to | Named people who should all have the same powers, and nobody from outside the company |
| 2 | Is the risky-command check on? | The approval setting | Asks every time, or the default smart mode. Never off, and never YOLO mode |
| 3 | Does it read anything a stranger can write? | The jobs you plan to hand it | If yes, the whole agent runs in a sealed-off space, and it cannot send, pay, or delete without a person |
| 4 | Where do its commands run? | The setting for where commands run | Not straight on a computer that holds anything else of yours |
| 5 | Can anyone outside the office reach its control screen? | How its dashboard is opened | Only from inside your network or through a private connection |
| 6 | Who read each add-on before it went in? | The list of installed add-ons | A named person who read the code itself, or no add-ons |
| 7 | Which version is it on, and who updates it? | Its version number against the newest release | Within a week of the newest release, with a named person and a backup |
| 8 | Can you undo a bad change? | The undo, or checkpoint, setting | Switched on, and someone has tried a rollback once |
The stop rule: if any of the first three is a no, the agent works on sample data and a practice account until it is a yes. Questions four through eight can be fixed in the first week, but the first three decide who can steer it and what it can do once steered.
How we keep our own Hermes agents in their lane
We run our company on 13 agents built on Hermes, so we hit one line in its policy early: "Within the authorized set, all callers are equally trusted." Hermes cannot give one person on an agent's list more power than another. The policy's own answer is to run separate agents with separate lists.
That is how we work. Each of our 13 agents has its own list of people allowed to give it work, and the narrowest of them answers only our three owners. Anyone on an agent's list can direct it as fully as anyone else there, so each list holds only the people that job needs. The rest of what we hold our agents to, such as a person approving every email before it goes out and an owner signing off on anything that moves money, is in what we require of the agents that run our own company. Our overall verdict after running Hermes since July is in our Hermes Agent review.
Frequently asked questions
Is Hermes Agent safer than OpenClaw?
Neither is safe or unsafe on its own. Both act with the logins you give them, so the setup decides the outcome. Our OpenClaw security guide covers OpenClaw's own record and defaults, and Hermes Agent vs OpenClaw compares the two for an owner.
Does Hermes Agent send my data anywhere?
It sends what it reads to the AI service you connect it to, because that is how it thinks. The April 2026 outside review found no hidden reporting back to its makers. Treat your AI service as a vendor that sees your files, and check its data terms.
Can Hermes Agent delete my files?
It can delete what its computer account can reach. Deleting a whole folder makes it pause for approval when that check is on, and a few disasters, like erasing the entire drive, are always blocked. Undo is something you have to switch on, so ask whether it is.
Is Hermes Agent free?
The software is free. You pay for the AI service it uses and the computer it runs on, plus the time someone spends keeping it updated. What Hermes Agent costs a small business to run prices those out.
Do I need a technical person to run it safely?
For a business, yes. Not a full-time one, but a named person who owns the allowed list, the settings, and the weekly updates. If nobody comes to mind, that is a good reason to get help. What Hermes Agent is and what it does is the place to start if you are still deciding whether you need one at all.
If you would rather not own its security
Hermes Agent works best for an owner who treats it like a new hire with keys to the office, with a short list of who can direct it and someone checking in on it every week. That weekly care costs more than the software does.
If you want the agent without that job, we do it for you. We build it into the tools your business already uses, keep it updated, and coach your team, with the build from $1,000 one time and hosting and maintenance from $200 a month (see pricing). Bring us the first job you would hand over, and we will tell you if running it yourself makes more sense.
