Skip to content

Project

Hermes Agent

Open-source AI agent from Nous Research that runs locally or hosted with a choice of underlying models; it has a business edition with enterprise controls.

Known aliases

  • Bot Mode
  • Hermes
  • hermes agent
  • Hermes Agent v0.20.3

Current stories

productConfirmed4 publishers

Reviewers find Nvidia's RTX Spark well ahead on local AI and behind the top chips on CPU

Windows Central and Tom's Guide each tested Nvidia's RTX Spark for a week in one laptop model, the Surface Laptop Ultra. Six partners start shipping this week, Windows Central says, so a pilot on any other chassis goes beyond what either review covered.

Perspective Coverage

4 publishers
Builder
Builder 41%
Operator
Operator 38%
Investor
Investor 21%

Reality

Evidence64
Adoption
Not scored
Hype gap+20
Incentives45
Confidence68
securityOne report1 publisher

Two GitHub scripts let responders rebuild OpenCode and Hermes agent sessions from disk

Two new Python scripts on GitHub rebuild OpenCode and Hermes AI agent activity for incident responders, according to an isc.sans.edu diary. Both accept a time range and evidence collected from the system under investigation, such as a mounted image or tarball.

Publishers:isc.sans.edu

Reality

Evidence45
Adoption
Not scored
Hype gap−5
Incentives
Not scored
Confidence65
buildOne report1 publisher

NVIDIA staggers RTX Spark agent and creative updates from Oct. 15 into November

NVIDIA says RTX Spark laptops go on sale Oct. 16 with up to 128GB of unified memory and 1 petaflop of AI compute. Its own list dates the agent, model and creative updates from Oct. 15 to November, so launch day starts a rollout.

Reality

Evidence30
Adoption
Not scored
Hype gap+35
Incentives80
Confidence45
buildOne report1 publisher

DeepSeek Harness lets a sandboxed agent escalate itself to full access via an unauthenticated API

DeepSeek Harness, DeepSeek's open-source agent runner, carries a 9.4-severity flaw that lets a sandboxed agent grant itself full access with one command. Its control API has no authentication and trusts a client-supplied Host header.

Publishers:dev.to

Reality

Evidence45
Adoption55
Hype gap+20
Incentives
Not scored
Confidence40
investConfirmed7 publishers

Nous Research bets its $90 million Series B on companies paying for controls around free Hermes code

Nous Research raised $90 million at a $1.5 billion valuation to sell its open-source Hermes agent to corporate IT departments. The money pays for single sign-on and audit controls, so the price depends on companies paying for features around code anyone may copy.

Perspective Coverage

8 publishers
Builder
Builder 29%
Operator
Operator 29%
Investor
Investor 42%

Reality

Evidence62
Adoption55
Hype gap+25
Incentives60
Confidence65
buildOne report1 publisher

Hermes Agent v0.21.2 routes passwords around its model straight into the login page

Hermes Agent v0.21.2 fills passwords from 1Password, Bitwarden or its own vault into web pages without the model ever seeing them. Every card fill waits for a person, so the agent cannot charge a stored card on its own, cron jobs included.

Publishers:dev.to

Reality

Evidence38
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence40
buildOne report1 publisher

Cloud Run instances kept an always-on AI agent's state across updates and restarts in a Preview test

Google's Cloud Run instances, priced from $5.70 a month, kept an open-source AI agent running with its memory intact in a developer's Preview test. For an agent that mostly waits, it trades a VM's patching for limits the code must be written around.

Publishers:dev.to

Reality

Evidence40
Adoption8
Hype gap+15
Incentives40
Confidence38
buildOne report1 publisher

Tool-call parsing splits coding agents into tiers on some models, not on native tool-call models

Polyglot's developer ran six coding agents 30 times on each of seven local models, and three never made a tool call on models that write calls as text. The author's own error bars say 30 runs can sort agents into tiers but cannot rank two agents inside one.

Publishers:dev.to

Reality

Evidence55
Adoption
Not scored
Hype gap+5
Incentives70
Confidence55
securityOne report1 publisher

Carbonato worms across unauthenticated Docker hosts to plant a Telegram-run AI agent

ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.

Reality

Evidence50
Adoption
Not scored
Hype gap+10
Incentives35
Confidence50
securityConfirmed3 publishers

CARBONATO botnet infects Docker hosts, prioritizing theft of AI provider API keys

CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.

Perspective Coverage

3 publishers
Builder
Builder 33%
Operator
Operator 57%
Investor
Investor 10%

Reality

Evidence60
Adoption
Not scored
Hype gap+20
Incentives35
Confidence60
buildOne report1 publisher

Stale OpenClaw bot accounts kept sending hourly Telegram messages after the channel was disabled

OpenClaw's Telegram enabled flag stopped inbound polling while cron-driven sends kept firing hourly through three stale bot accounts, one operator reports. The dashboard showed the channel off, and the sends ended only when the bot tokens left the secrets directory.

Publishers:dev.to

Reality

Evidence35
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence40
productConfirmed11 publishers

Google now lets Premium Advanced subscribers point Claude at their Home device graph

The new Model Context Protocol endpoint reaches every device and the whole event history in Google Home, but only for US subscribers on the paid Premium Advanced tier, and Google is shipping it as early access.

Perspective Coverage

12 publishers
Builder
Builder 35%
Operator
Operator 50%
Investor
Investor 15%

Reality

Evidence70
Adoption10
Hype gap+35
Incentives60
Confidence75
buildOne report1 publisher

One operator steering three AI agents stole 600,000 cards for an estimated $12,000 to $18,000, Gambit says

Gambit Security says one operator used three AI agent tools to steal over 600,000 cards, spending an estimated $12,000 to $18,000. One retailer's scheduled job reinstalled a skimmer after a deploy removed it, so recovery tests have to cover every layer the agents touched.

Publishers:runtimewire.com

Reality

Evidence50
Adoption
Not scored
Hype gap+20
Incentives70
Confidence45
productOne report1 publisher

Rabbit's OS3 makes the R1 optional and runs on the user's own API key

The company known for a pocket gadget now ships a cloud agent that installs on up to five Windows, macOS or Linux machines and runs on whatever model subscription the user already pays for. Four rival agents got there first.

Publishers:siliconangle.com

Reality

Evidence32
Adoption12
Hype gap+28
Incentives72
Confidence44
buildOne report1 publisher

OpenRouter's P50 puts Mercury 2.5 at 440 tok/s against Inception's reported 1,107

Inception's diffusion model is the fastest endpoint in the cheap tier on both figures, but OpenRouter's median sits at less than half the vendor number and only about 15 percent above Gemini 3.5 Flash-Lite's measured 382 tok/s.

Publishers:dev.to

Reality

Evidence45
Adoption58
Hype gap+28
Incentives62
Confidence42

Earlier coverage

  1. Google hands five outside coding agents access to its Home devices

    Product · September 17, 2026 · One report1 publisher

  2. Eight agents, four days, 1,395 files: the AI intrusion campaign that mostly ran itself

    Security · August 18, 2026 · Confirmed2 publishers

  3. Seven agentic AI incidents, one front door: the identity metadata you publish on purpose

    Security · August 14, 2026 · Confirmed2 publishers