Working with Hermes, Tested

A guide to Hermes Agent for people who direct an assistant rather than program: what it is, which model sits under it, the files it reads, how it asks before acting, and which habits held up on a small folder of files

What works when you direct Hermes Agent, the open agent runtime from Nous Research, with ChatGPT Terra under it: the instruction files and memory it reads, the approval prompts and what they do not protect, and five habits each tested plainly and carefully on the same made-up folder, with the same tests on a free model beside them. Last checked November 2026.
Author

Behzad Samadi

Published

November 14, 2026

Last checked 14 November 2026, on ChatGPT Terra (gpt-5.6-terra, through the ChatGPT sign-in), in Hermes Agent v0.23.1 (2026.9.24).

This guide is for someone who uses an assistant to get things built or sorted out, not to write code themselves. Hermes Agent is different from the others in this series in one way that matters: it is not a model. It is a program, free and open source (MIT licence, from Nous Research), that lets whatever model you choose read your files, run commands and remember things. You can use it in a terminal and in a desktop app, and Hermes’s documentation describes it answering you in messaging apps too; you decide which model and which company’s servers do the thinking.

So there are two questions. What does Hermes add, whichever model you give it? And what depends on the model? A test of one model cannot separate them, so this guide ran everything twice: on ChatGPT Terra, which is the result it reports, and on a free model from OpenRouter, shown near the end as a comparison. Where they differed, the model was the only thing that changed.

The practices were tried on the same small folder of made-up files as the other guides in this series: a garden club’s seven sets of committee minutes, with untidy names, and a members list with four traps in it. Each task was asked plainly and then with the habit being tested, three times each, each run in a fresh copy of the folder. The counts are small, so the guide says “in three runs out of three”, not “always”.

If you have not yet let an assistant work on a folder, start with Let It Open the Folder. For Hermes beside other coding agents, see One Repository, Three Agents.

NoteIn short
  1. On Terra, Hermes found the facts in the folder every time it was asked, and said the 2025 water bill was not there in six runs out of six. The habits changed less than they did for other assistants: the instruction file moved the notice from 9 to 10 out of 10 in three runs out of three, and asking for a plan first brought a checksum check in three runs out of three, where plain asking brought none.
  2. Asking for evidence did not help on the fee question. Plainly, Terra gave the right $855.00 in two runs out of three, after running a script each time. With the careful wording it ran a script every time too, but in two runs it answered a narrower question (“this year” as the three people who joined in 2026, $135.00).
  3. The model decides a lot. On the free model, the same instruction file was followed whenever a notice was written, but in six of nine runs with rules loaded the agent never read the notes; on Terra it never did that.
  4. Hermes asks before dangerous commands, and that is all it confines. In a one-shot run it refuses what it flags as dangerous and everything else runs as you. Its terminal is not limited to your folder, and in one run it wrote a file you had not asked for.

Which one you are using

What it is Tested here
Hermes in the terminal (hermes) The agent in a terminal: type, it reads files, runs commands, edits Yes, one-shot (hermes chat --oneshot)
Hermes Desktop A desktop app on the same agent No
Messaging gateway The same agent answering you in messaging apps (Hermes’s memory page names Telegram and Discord) No
Web dashboard, editor connection (ACP), scheduled jobs Other ways in, listed in hermes --help No

Hermes is installed with a script from hermes-agent.nousresearch.com or from the project’s repository, and its documentation warns of fake Hermes sites and lookalike accounts: use the addresses on its official domains page. It costs nothing to install. What you pay for is the model: you point Hermes at a provider (hermes model chooses one; -m and --provider override it for a single run). The tests signed in with a ChatGPT account (the openai-codex provider); the free comparison used an OpenRouter key.

This guide was tested in the terminal, one-shot, because a script can run it the same way each time and keep what it wrote. Everything below about the desktop app, the gateway and the dashboard is from Hermes’s documentation, or left out.

How the tests were run

Each run was one command, in a fresh folder:

hermes chat --oneshot --query-file prompt.txt \
  --provider openai-codex -m gpt-5.6-terra \
  -t file,terminal,todo --in <folder> --format stream-json
  • The model was ChatGPT Terra, gpt-5.6-terra, the id Hermes lists for its ChatGPT provider; the first line of every run’s output reports it back. The ChatGPT sign-in reported the Plus plan.
  • A clean start. Hermes keeps its settings, memory, personality file and skills in a folder in your home directory. The runs used a new, empty one, so the tester’s own memory and skills did not shape the answers. Hermes filled it with its defaults, as it does for a new user. Only the sign-in for the ChatGPT provider was copied in, without its refresh token, and deleted afterwards.
  • What was available. Hermes’s file tools (read_file, write_file, patch, search_files), the terminal, a to-do list, and Hermes’s own look-up tools (hermes_tool_search, tool_describe, tool_call), which find other tools; nothing was configured for them to find. No web, browser, memory, messaging or other services. The three skill runs loaded one skill.
  • Approvals stayed on. Hermes has a faster one-shot command, hermes -z, but the installed hermes --help says it bypasses approvals, so it was not used, and neither was --yolo. A one-shot run applies the setting for runs with nobody present to answer: the default is to refuse any command Hermes flags as dangerous. Writes by Hermes’s own write tools were limited to the folder that holds the test folders. Commands run in the terminal were not limited to it; see the permission probe under What did not hold up.

Giving it context

Files. Hermes reads and edits what is in the folder it starts in. You can point it at another with --in.

The instruction file. A plain text file called AGENTS.md in the folder. Hermes’s documentation: it is “loaded into the system prompt at startup from your working directory”. Only one project file is used per session, the first found of .hermes.md, AGENTS.override.md, AGENTS.md, CLAUDE.md, .cursorrules, so a folder prepared for another assistant can work. Outside a git repository only the folder itself is checked (documentation, not tested). Changes take effect at the next session (its which-file-does-what page).

In the test, house rules saved as AGENTS.md in a brand-new folder were read at once: asked what rules it had, Hermes quoted all six, with no “do you trust this folder” step. With --ignore-rules it answered “None.” (The installed help says that flag also skips the memory and the personality file.)

Three other files decide how Hermes behaves, and they are not the same thing. From Hermes’s documentation, not tested:

File What it is Who writes it
SOUL.md The agent’s personality and tone, for every session; lives in the Hermes folder you
MEMORY.md and USER.md Its own notes (2,200 characters) and a profile of you (1,375), under the Hermes folder’s memories the agent, by itself
AGENTS.md Rules for this folder you

The documentation says memory is read once at the start of a session and does not change until the next, and warns against two Hermes processes sharing one home folder. The memory was switched off in these tests, so this guide cannot say how well it works. It does mean something else: on a Hermes that has been used for a while, the answers you get are also shaped by what it has written about you, and the test folder here was not.

Skills. A skill is, in the documentation’s words, an “on-demand knowledge document”: a folder with a SKILL.md holding a name, a one-line description and instructions that Hermes loads when they are needed. Hermes ships with a catalogue of its own. The same house rules were also tried as a skill, loaded with --skills house-rules.

What the instruction file did

The task: Write the notice to members about the work day, from the committee’s notes. Save it as notice.md. The club has six house rules for anything sent to members:

- Dates in full, with the weekday and the year: Saturday 14 November 2026.
- Times on the 24-hour clock: 09:30, not 9:30 am.
- British spelling.
- No exclamation marks.
- Under 120 words, heading and signature included.
- Signed "The committee", with no personal names.

Marked out of 10: four facts (the date, the times, gloves, soup) and the six rules.

Run 1 Run 2 Run 3
No instruction file 9 9 9
Rules in AGENTS.md 10 10 10
Three more runs with the file 10 7 10
Three runs with the rules as a skill 10 10 10

Without the rules, all three notices (50 to 64 words) had the four facts, no exclamation marks and a signature of “The Committee”; each gave the date as “Saturday 14 November”, without the year, which is the mark each lost. With the rules, every one of the nine notices followed all six rules; eight also had all four facts. The ninth (an extra run) had the date and the tool sharpener but no times, gloves or soup.

Practices that held up

Tested on 14 November 2026, in Hermes v0.23.1, on ChatGPT Terra. Each was run three times plainly and three times with the practice, each in a fresh copy of the folder.

Brief it, do not just ask it

Plain: What do we still need to do?

With the practice: Goal: a list of the committee’s open actions, so nothing is forgotten before the garden closes for winter. Read every file in notes/. An action is something a named person, or the committee, agreed to do. It is open unless a later note says it was done. If an action was carried over, list it once, with its latest date. Write actions.md with one table: action, who, due date, the note it was last mentioned in. Under the table, list anything you were unsure about and why. Do not change any other file.

Marks out of 9 Run 1 Run 2 Run 3
Plain 9 7 9
Brief 9 9 9

The first attempt at plain run 2 failed with a provider error (the ChatGPT connection stalled for about ten minutes and Hermes gave up); the repeat is the one marked. In it Terra listed four of the five actions, missing the work-day notice, and added “finalize the checklist”, which the notes do not record anyone agreeing to. The other two plain runs and all three briefs had the five, each with who and when. The briefs put them in a file, and the doubtful cases under the table: in one, that “do not pay the invoice until the $80 is explained” is a decision, not an assigned action; in another, two extra rows (the invoice, and who supplies soup) added and labelled as judgement calls.

Plan first when it is going to change files

With the practice, first message: I want the notes folder tidied: every note named for the date of its meeting, as YYYY-MM-DD-committee-meeting.md, and a notes/index.md that lists each note with one line on what was decided. The text of the notes must not change. Do not change anything yet. Tell me your plan: what you will rename to what, how you will work out each date, and how you will check afterwards that no text was lost. Then stop.

Second message, same session: Go ahead with that plan. When you finish, tell me what you checked.

The plain version was Tidy up the notes folder: consistent file names, and an index.

Run 1 Run 2 Run 3 Ran a check that the text was unchanged
Plain passed (lenient) passed (lenient) passed (lenient) no, in three runs out of three
Plan first passed passed passed yes, in three runs out of three

“Passed (lenient)” is the check made for the plain prompt, which names neither a file-name pattern nor an index name, so it accepts any sensible ones. Run through the strict check (the pattern and notes/index.md), two of the three plain runs passed and the third failed only because it put the index in notes/README.md. All three plain runs chose the pattern YYYY-MM-DD-committee-meeting.md themselves and dated the file called “25 aug” as 26 August, but none said so, and none ran a checksum or comparison: their replies say only that the index links resolve. In all three plan-first runs the plan stopped as asked with no file changed (its first turn used only Hermes’s search and read tools), named the 25 August file as the meeting moved to the 26th, and afterwards ran SHA-256 checksums of every note before and after, as the tool calls show.

Ask for the evidence, not just the answer

Plain: How much have we collected in fees this year?

With the practice: How much have we collected in fees this year? Before you answer, look through members.csv for anything that would make a simple sum wrong: duplicates, blanks, refunds, odd formats. List each one you find and say how you treated it. Then give the total, the number of members, and how you checked the total.

The right answer is $855.00; a plain sum of the column gives $900.00. Marks out of 5: the total, and each of the duplicate member, the blank fee and the refund named.

Run 1 Run 2 Run 3
Plain 2 4 5
With the practice 3 3 5

Every Terra run opened the file and ran a script or command on it (Python, awk or sqlite3); none claimed a check it did not run. Plainly, run 1 said $900.00 (it named the refund and the unpaid member, not the duplicate); runs 2 and 3 gave $855.00, with the duplicate and refund named, and run 3 the unpaid member as well. With the careful wording, run 3 gave $855.00 with all three problems, 22 members and 20 with a positive net fee. Runs 1 and 2 named all three problems but headed their answer with $135.00, the three people whose joined date is in 2026, because the file has no payment date; run 2 gave $855.00 only as “a cross-check”. That reading is defensible, but it is not the question the club meant. Run 2 also wrote a file you had not asked for into the folder (member_fee_audit.sql) and tried to write another inside Hermes’s own data folder, which Hermes refused; its reply does not mention the file.

Say “only from these files”

With the practice: Answer only from the files in this folder. If the answer is not in them, say so, and say what the files do contain on the subject. What did the club pay for water in 2025?

The 2025 water bill is not in the files; the 2026 ones are, and so is a 2025 electricity bill.

Run 1 Run 2 Run 3
Plain right right right
Only from these files right right right

All six said the figure is not there, and none offered a number. The plain runs mentioned only the 8 September note (“a little under last year’s pace”); the careful ones also gave the 2026 figures ($312.40, $486.75) or said that Paolo did not have the 2025 figure with him. None mentioned the $96.20 electricity bill. On this task, with only the folder to read, the habit changed nothing.

What did not hold up

Loading rules does not make every model read the files. On the free model, six of the nine runs with rules loaded (the file or the skill) never read a note and wrote nothing (see below). On Terra none did. The same instruction file and the same skill, a different model.

The “.” search. Of the six free-model runs that gave up, five began with Hermes’s search_files with pattern . and target files (the sixth made three searches, the second with .), which returned zero results in a folder that was not empty; the agent took that for an empty folder and asked for the notes. Plain free-model runs searched with * or for words, or listed the folder with the terminal, and found the files; one run began with the . search, got nothing and then listed the folder and carried on. It looks like a Hermes tool quirk as much as a model slip, and it was not isolated by a separate test. Terra’s first call in all twelve task 2 runs was a * search.

The one-shot shortcut. hermes -z is the form scripts and tutorials reach for. The installed hermes --help says “approvals are auto-bypassed” (the online CLI page was not checked for that sentence, and -z was not run). Use hermes chat --oneshot if you want the approval rules to apply.

“The safe-root setting keeps it in the folder.” It confines Hermes’s own file tools. A shell command is not confined by it: in a probe, rm -rf was refused as dangerous, but a shell redirect to ../outside.txt wrote a file one folder up without a question, on both models. Hermes’s security page says the same: only write_file and patch are covered.

Unasked files. One Terra run left a file in the folder it was not asked to make (above); one free-model run left a script, analyze.py. In neither did the reply say so.

Tips from elsewhere were not collected for this guide; the research folder’s notes/leads.md lists what was noticed and left untested.

The same tests on a free model

Before the Terra runs, the same thirty runs and six extra ones were made on nvidia/nemotron-3-ultra-550b-a55b:free through OpenRouter (listed at $0), in the same Hermes with the same clean start. Marks from the saved records:

Task Free model, plain Free model, practice Terra, plain Terra, practice
1 open actions (of 9) 9, 9, 9 9, 9, 9 9, 7, 9 9, 9, 9
2 notice (of 10) 9, 6, 8 no notice, 7, no notice 9, 9, 9 10, 10, 10
3 tidy 3 of 3 pass (lenient); 0 of 3 strict 2 of 3 pass 3 of 3 (lenient); 2 of 3 strict 3 of 3 pass
4 fees (of 5) 0, 2, 2 5, 3, 5 2, 4, 5 3, 3, 5
5 water 3 of 3 right 3 of 3 right 3 of 3 right 3 of 3 right

What differed:

  • Task 2 with rules loaded: the free model wrote a notice in 3 of 9 runs (7, 7 and 7 out of 10, all following the six rules but missing the times, gloves and soup); Terra wrote all nine.
  • Task 4: on the free model, plain gave $900 twice and, once, asked a question without opening a file. With the careful wording, two runs gave $855.00; but one of them said it had parsed the file with Python, and the record shows only a file read and no command. The other careful run and one plain run did run a script or command; the third careful run claimed a check with no command either. Terra’s six runs all ran one.
  • Task 3: the free model’s plain runs used shorter names (2026-08-26.md) and none ran a checksum; one of its three plan-first runs said it had checked “byte-for-byte” but ran no comparison command, and one failed the strict check because its index lines gave dates but not file names.

Three runs each, one model per column: these are the observed differences, not a ranking of the models.

What the tests do not show

  • Two models, three runs each, one day. A different model, or Terra on a different day, may give different marks. The comparison above is the only evidence in this guide about how much the model matters.
  • Six extra runs. Six extra runs of task 2 (three more with AGENTS.md, three with a skill) were made on each model after the first free-model runs gave up; they are shown beside the thirty, not in them.
  • A clean Hermes. The runs used an empty Hermes folder: no memory, no personality file of the tester’s, few tools. A Hermes you have used for a month behaves differently.
  • The terminal, one-shot only. The desktop app, the gateway, the dashboard, the memory tool, MCP connections, Docker and the other approval modes were not tested; what this guide says about them is from Hermes’s documentation.
  • Looser confinement than the other guides’ tests. Hermes’s terminal ran as the tester’s user, in a temporary folder, with only the dangerous-command check between it and the rest of the computer.
  • Usage. The 39 turns on Terra used about 1.2 million input tokens and 46,000 output tokens. The ChatGPT Plus account’s usage windows read 15% (5 hours) and 26% (weekly) afterwards, including anything else done with it, so the cost of the runs alone is not known.

Where your data goes

Hermes itself runs on your computer. What you type and what it reads go to the provider of the model you chose, and Hermes cannot make that provider’s rules better.

With a ChatGPT sign-in (the Terra tests): your prompts and the file contents it reads go to OpenAI under your ChatGPT account. OpenAI’s data controls were not read for this guide; check them.

Through OpenRouter (the free comparison): your prompts go to OpenRouter and on to the company that runs the model. OpenRouter’s page on provider logging and data retention says each provider has its own policy, and that your account has a setting for whether OpenRouter may route to providers that “may train on your data”, with “separate settings for paid and free models”. Check it before using a free model with anything private.

No statement about Hermes itself collecting usage data was found in the documentation; that is not the same as a statement that it does not.

What stays on your computer, in the Hermes folder: in the tests’ empty one Hermes created, among other things, memories, skills, sessions and logs, and the installed help refers to a .env file for credentials. Treat the folder as private, and keep it out of anything you share.

Settings worth changing (from Hermes’s security page; none of these was tested except where said):

  1. approvals.mode is smart by default: a second model call judges, refusing what is dangerous and asking when unsure. manual always asks; off is the same as --yolo. Only the smart default was run.
  2. approvals.deny: your own never-allowed command patterns, for example git push --force*, checked even under --yolo. A fixed list of catastrophic commands is always refused. Not tested.
  3. For anything that matters, the documentation says to run the terminal in Docker (terminal.backend: docker), where the container is the boundary. Not tested.
  4. Give it a copy of the files it needs, not your whole Documents folder.
  5. One Hermes folder per person or experiment; Hermes’s memory page says to give a second agent its own profile (hermes profile). Not tested.

The moving parts

As read on 14 November 2026.

  • Hermes Agent v0.23.1 (2026.9.24), installed from git. hermes update moves it; flags and defaults change between versions.
  • The model. Chosen by you. The tested one was gpt-5.6-terra, as Hermes lists it for the ChatGPT sign-in (openai-codex); the same list also names gpt-6-sol, gpt-6-luna, gpt-5.6-sol, gpt-5.6-luna, gpt-5.5, gpt-5.4 and gpt-5.4-mini. Hermes’s online catalogue names a openai/gpt-6.1-terra for OpenRouter and Nous, a different listing. ChatGPT Plus, as the sign-in reported it; no price is given here.
  • The free comparison model, nvidia/nemotron-3-ultra-550b-a55b:free, is listed on OpenRouter at $0 with 1,000,000 tokens of context; the paid version at US$0.60 per million input tokens and US$2.40 per million output.
  • The approval settings, as defaults: approvals.mode: smart, single_query_mode: deny (a one-shot run refuses dangerous commands), terminal.backend: local.
  • The instruction files, in the order Hermes takes the first it finds: .hermes.md, AGENTS.override.md, AGENTS.md, CLAUDE.md, .cursorrules.

What changed

  • 14 November 2026. First published.

Sources

Hermes’s documentation, read on 14 November 2026 from the copy installed with v0.23.1. The same pages are published under hermes-agent.nousresearch.com/docs; the online text was not read or compared. The research notes, the test logs and each run’s output are in the accompanying folder. The made-up folder, prompts and answer key shared by all the assistant guides are in the common folder.