Reddit and RSS Without a Browser: Hermes Reads Communities and Feeds From Any Server
Two new bundled skills landed on Hermes main on September 5, 2026: rss-feeds turns RSS/Atom/JSON feeds into a clean list (with feed auto-discovery), and reddit-reading reads subreddits, search, threads, and users with no browser and no login — anonymous by default, or ~100 req/min via a free app-only OAuth upgrade.
Read more
Hermes Now Hands You the Files Its Agent Creates Inside Remote Sandboxes
When Hermes runs its hands inside a remote sandbox (SSH, Modal, Daytona, Singularity, Vercel), files the agent creates there — screenshots, charts, reports — used to vanish with a 'Skipping unsafe MEDIA directive path' log line. Since 2026-09-05 the gateway pulls sandbox files back over the exec channel and delivers them normally: 50MB cap, the host denylist applied twice, symlinks to credentials refused. This post explains the MEDIA: tag mechanism, the fix, and its security boundaries.
Read more
Hermes Meets Perplexity Search: One API Key Upgrades Both Web Search and Page Extraction
Perplexity Search API is now an official backend for Hermes web_search and web_extract (merged to main September 4, 2026). How to configure the key, switch backends, and why its extract returns query-relevant snippets, not full pages.
Read more
Run Hermes on Local Models: No API Key, No Account, Works Offline
Hermes can now run open models entirely on your own machine — it downloads and manages the llama.cpp inference engine, picks the right quantized build for your GPU, and handles VRAM end-to-end. No account, no API key, and no network access after a model is downloaded. A step-by-step guide to the new Local Models runtime, the model catalog, the memory management logic, and the config keys.
Read more
The Repo Ran Code Before You Typed a Word: GitSpawn and How Hermes Fixed It
A teammate zips up a project, you unzip it, drop the folder into Hermes, and before you type a single instruction — attacker code has already run as you, on your machine. That is GitSpawn, a vulnerability class disclosed by Manifold Security on September 1 that spans Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent. Coding agents run git automatically to gather context before any prompt or trust gate, and a repo's own .git/config can point git at an arbitrary program (core.fsmonitor, hooksPath, and diff drivers are all execution sinks). Hermes merged its fix on September 2 (PR #101483, on main): every automatic git probe now runs in a sanitized environment, and diff rendering forces --no-ext-diff --no-textconv. This post explains the attack, how it spreads, and how to check your own setup.
Read more
Hermes v0.21.0: Bot Mode Built In, Agents That Message Each Other, and Cron Jobs That Remember
v0.21.0 (The Pantheon Release) ships Bot Mode built into the desktop app with group chats and named agent avatars, adds the hermes peer command for bot-to-bot DMs across profiles and gateways, gives cron jobs persistent memory and continuity, lets you steer subagents live, turns the MCP surface into a command center, and hardens security across instruction files, redaction, and Windows approvals.
Read more
hermes peer: Let Your Agents DM Each Other Across Profiles and Machines
Your research agent found the answer — now you copy-paste it into your coding agent's window by hand. hermes peer (shipped in v0.21.0) lets any Hermes agent message any other agent by handle, across profiles and gateways: register a peer gateway, then hermes peer dm spark "disk status?" delivers into the remote agent's canonical Bot Chat and prints the reply. Long tasks run asynchronously with hermes peer run + idempotency keys, and exit codes stay script-friendly.
Read more
hermes approvals test: Ask the Approval System Before You Run That Command
Ever wondered whether a command will trip Hermes' approval gate — without actually running it? hermes approvals test (v0.21.0) dry-runs any command against the real guards: hardline blocklist, your approvals.deny rules, dangerous-pattern detection, allowlist, and yolo/off bypass. It prints the verdict, the matching rule, and the normalized command trace, and exits 0 (allow), 2 (ask), or 3 (deny). Bonus: hermes approvals suggest mines your approval history into allowlist proposals.
Read more
Cron Jobs That Remember: Memory and Continuity for Your Scheduled Agents
Your 9am briefing job has told you the same three items for a week, because every run starts from zero — scheduled jobs were goldfish. v0.21.0 changes that: cron agents now load and update persistent memory like any other agent, the --continuity flag injects the previous run's output into the next (so a monitor can dedupe and continue where it left off), every job gets a durable notepad via hermes cron notepad, and monitor-mode jobs skip the LLM entirely when nothing changed.
Read more
skills.create_dir: Make New Skills Land Where Your Config Says — Not Where the Prompt Gets Ignored
Telling your agent 'create skills in /opt/brain/skills' in a prompt is a suggestion; the skill_manage tool writes to ~/.hermes/skills/ and no system prompt can out-argue a file path. The new skills.create_dir config key (PR #100377, merged Sep 1) routes agent-created skills to any directory — and every instruction string, tool schema, and doc that names the creation path dynamically renders your configured directory, so config, tool, and prompt finally agree.
Read more
Your Cron Jobs Died Silently? One Command Gives the Whole Fleet a Checkup
Your scheduled jobs may have been quietly dead for days without you knowing — cron list and cron status both look "normal". The new hermes cron doctor command checks every job in one pass: failed runs, failed deliveries, overdue next_run_at, missing scripts, and dead workdirs, exiting 1 when anything needs action. Merged August 31 (PR #99479), currently on main only.
Read more
Multi-Profile Cron Finally Stops Cross-Talking: Every Profile Delivers via Its Own Bot
If you run Hermes with multiple profiles, you may have seen it: profile B's cron result arrives from profile A's bot — or fails with "Bot not in chat" entirely. A fix merged August 31 (PR #99375) makes delivery identity follow the job's owning profile: each profile sends via its own bot, its own credentials, and its own home chat, and hermes -p X cron status stops lying.
Read more
Status Bar Upgrade: Cache-Hit Rate, Latency, and Tokens/sec at a Glance
Hermes' CLI status bar gained three new metrics: prompt-cache hit rate (◎), rolling average latency (◷), and output tokens per second (↑) — and every field can be toggled via display.status_bar.fields. The cache-hit rate is a direct line to your API bill: more hits, much lower cost. Merged August 30 (PR #98250), currently on main only.
Read more
"Session Not Found"? state.db Now Detects, Quarantines, and Heals Itself
Hermes stores all session history in state.db. In the past, when the database got corrupted you only saw a baffling "session not found" — and the system kept writing into the broken database, making the damage worse. A batch of fixes merged August 30-31 (PR #99513 and siblings) teaches Hermes to handle corruption properly: detect it, quarantine the bad file, heal what can be healed, and fail loudly instead of pretending everything is fine.
Read more
Search Every Hermes Command and Skill in Telegram: The @botname Inline Picker Bypasses the 60-Slot Menu Cap
Telegram hard-caps the / command menu (100 per scope, ~4KB payload; Hermes defaults to 60 slots), so skill commands fall off once you install enough of them. A feature merged August 30 bypasses the cap entirely: type @yourbotname + a keyword in any chat and get a live, searchable picker over every command and installed skill — computed per keystroke, paginated 50 at a time, one tap sends the command into the chat.
Read more
No More 5-Minute Approval Stalls for Unattended Hermes: The New approvals.unattended_mode Key
Webhook, msgraph_webhook, and api_server sessions used to block for the full 60-300s approval timeout when they hit a dangerous command — because no human exists to answer /approve on those surfaces. A fix merged August 30 adds approvals.unattended_mode (default deny) so those sessions fail instantly with a clear reason instead of stalling, plus single_query_mode for hermes chat -q one-shot sessions.
Read more