Don't trust Hermes Agent with anything that matters
Hermes Agent promises something genuinely appealing: connect a capable language model to tools, give it persistent context, and reach it through interfaces such as Telegram. Ollama also presents it alongside OpenClaw, Claude Code, and Codex as one of the ways to use hosted models. I wanted to see whether it could work as a practical personal agent rather than another interesting demo.
I tested the hosted version through a $20 Nous Portal subscription. Using the managed environment removed most of the setup work and gave the product the best possible chance to make a good first impression. It did not.
Reliability problems appeared immediately
The dashboard was slow and frequently displayed conflicting state. After changing the default model, some parts of the interface showed the new selection while others continued to show the previous one. Telegram configuration produced similar inconsistencies.
This may sound like ordinary interface polish, but state management is part of the security model of an agent platform. If the dashboard cannot reliably tell me which model, integration, or access option is active, I cannot reliably reason about the system I am operating.
The default model was Claude Opus 4.8, an expensive choice whose purpose was not explained. A cheaper model might be entirely sufficient for many background tasks, yet the product offered little help in understanding the cost and capability trade-off. Combined with the stale interface state, I was never fully confident which model the agent was actually using.
The roughness extended to basic tool behavior. When I asked Hermes to send a voice message through Telegram, it initially returned the path to an OGG file on the server instead of sending the audio. The same request eventually worked after several attempts. That is inconvenient in a chat demo and unacceptable in an automation that is expected to act without supervision.
The context isolation test failed
The most serious problem was not the interface.
I added personal information to the agent's context, then asked a direct question: if I add you to another Telegram group, will you reveal information from this context? Hermes answered that it would not.
I added it to a test group and asked about the stored context. It disclosed the information.
An assurance produced by a language model is not a security boundary. I knew that before running the test. The problem is that Hermes presented one shared agent across conversational contexts without making the actual isolation rules clear. A normal user can easily interpret the model's confident answer as a statement about the platform's configuration.
Private context should be separated by design. A group chat should receive an isolated context, an explicit allowlist of memories, or no persistent memory at all. The model should never be responsible for deciding whether another participant may access data that the platform has already placed in its prompt.
Configuration should fail closed
The gateway configuration did not improve my confidence. One option, GATEWAY_ALLOW_ALL_USERS, is documented as suitable only for development environments. It had no obvious default in the configuration I inspected, so I set it explicitly to false.
Security-sensitive options should have unambiguous defaults and a visible effective state. A user should not have to infer whether an absent value means disabled, enabled, or inherited from somewhere else. For a system connected to messaging platforms and private context, uncertainty is already a failure.
The installer showed the same rushed character. On Windows, it used npm.cmd through a shell as a fallback for PowerShell execution-policy problems. It worked around the symptom, but it also made the installation path harder to reason about. This kind of fallback is tolerable in a personal script. In an agent platform that may execute commands and hold credentials, every extra shell boundary deserves more care.
My conclusion
Hermes has an attractive idea underneath it. A personal agent that can use different models, retain context, run tools, and communicate through Telegram is useful. The version I tested did not provide the predictability required to trust that idea with real work.
The interface reported inconsistent state, basic actions behaved unreliably, security-related configuration was unclear, and private context crossed into a group conversation during a simple isolation test. Any one of those problems could be fixed. Together, they describe a product that is not ready to hold confidential information or perform consequential actions without supervision.
I would not use the hosted subscription for sensitive work, and self-hosting does not remove the architectural questions around context separation and authorization. Hermes may still be useful as an experiment in a disposable environment. I would not trust it with anything that matters.