Hermes Agent for Beginners | How to Run Open-Weight Models Safely Through Fireworks AI, and Where to Draw the Line on Your Data

Hello, this is Ryuta Hamamoto from TIMEWELL. On September 10, 2026, Ricoh Japan announced that it is bundling Hermes Agent, an open-source AI agent, into its on-premises LLM starter kit¹. A major Japanese vendor shipping someone else's open-source agent inside its own product. A year ago that would have been hard to imagine. Hermes now has more than 240,000 stars and 50,000 forks on GitHub². In my previous piece on five ways to cut the cost of AI coding agents, I described Hermes as the open-source agent whose security documentation had reached the point of spelling out sandboxes and write-protected paths. This article picks up from there and actually gets it running.

I am writing for two readers. The person who is not an engineer but wants to try an AI agent on their own laptop, and the IT manager who has just been asked "can we use an open-source agent at work?" and does not yet have an answer. For the model behind the agent, I will use open-weight models such as Kimi K3, DeepSeek V4 and GLM 5.3 served through an inference provider, with Fireworks AI as the worked example. Two reasons: they are cheap, and you can swap them. The moment you add the word "safely", though, a handful of settings become non-negotiable. Most tutorials skip them, so this one spends most of its length there. If you want a quick read on where your organisation stands, the AI readiness check takes about three minutes.

Summary: Hermes Agent is an MIT-licensed, self-improving AI agent from Nous Research. It installs with a one-liner and switches models with hermes model. Fireworks AI is a built-in provider: set an API key and you can run Kimi K3, DeepSeek V4, GLM 5.3 and others at per-token prices. Fireworks states zero data retention by default, but serverless requests are processed across a global fleet and there is no Japan-only option. Safe use comes down to leaving approval mode on its default, and using the Docker sandbox plus the egress proxy so the agent never touches your real keys or your host machine.

What Hermes Agent is, in three minutes

Hermes Agent is an open-source AI agent released in 2026 by Nous Research, a US AI research group. The README calls it "self-improving": each time it completes a task it can save the procedure as a "skill" and reuse it next time. It searches its own past conversations, builds a model of your preferences, and autonomously runs terminal commands, edits files, searches the web and drives a browser².

Three things stand out. First, it is not tied to any model. The README says you can "use any model you want — Nous Portal, OpenRouter, OpenAI, your own endpoint" and switch with a single command, hermes model². Second, it is not tied to any place. You can talk to the same agent from the terminal or from Telegram, Discord, Slack, WhatsApp or Signal, and it runs on your laptop, on a $5 VPS, or inside isolated backends such as Docker, SSH, Modal, Daytona and Vercel Sandbox². Third, the pace of development. Version 0.21.0 on August 31, 2026 rolled up roughly 5,800 commits and 2,475 merged PRs since the previous major release, and v0.21.2 on September 11 covered 947 commits from 140 contributors in just four days³.

That pace cuts both ways. The good side is that security fixes and support for new models land within days. The side to watch is that config keys and commands can change between versions. Everything in this article reflects the official documentation as of September 12, 2026. If you are reading this six months later, check the docs first.

Nous Research was founded in 2023 and, according to TechCrunch, was in talks in July 2026 to raise funding at a $1.5 billion valuation⁴. Its revenue comes from a subscription called Nous Portal: a free tier with free models only, and paid tiers at $20 a month (with $22 of credits), $100 and $200⁵. This matters. The agent is free, but somebody has to pay for the model behind it. Whether that is Nous Portal, an inference provider like Fireworks, or your own GPU is the decision the second half of this article is about.

Adoption in Japan has been quick. In May 2026 NVIDIA wrote on its official blog that Hermes had passed 140,000 stars in under three months and, by OpenRouter's count, had become the most-used agent in the world⁶. Then came the Ricoh announcement. Ricoh Japan pre-installs its own LLM and Dify on a compact desk-side AI server and has now added Hermes Agent, with Dify handling routine work and Hermes handling non-routine work that needs judgment. Its pitch is that confidential data never leaves the building and there is no per-token billing¹. The fact that an on-premises product now ships an open-source agent tells you how far this category has matured.

"Open-weight" and "where it runs" are two different questions

Before we touch any settings, one piece of vocabulary. An open-weight model is one whose trained parameters (the weights) are published, so anyone can download them and run them in their own environment. DeepSeek, Qwen, Kimi and GLM fall in this group, as do OpenAI's gpt-oss, Google's Gemma and NVIDIA's Nemotron.

Two misunderstandings come up constantly. The first is "open-weight means open source". The weights may be public, but the license terms differ by model. Here is what Hugging Face showed on September 12, 2026⁷.

Model	Publisher	License	What to check for business use
DeepSeek V4 Flash (0731)	DeepSeek	MIT	Effectively unrestricted
Qwen3.8 27B	Alibaba	Apache 2.0	Effectively unrestricted
gpt-oss-120b	OpenAI	Apache 2.0	Effectively unrestricted
Gemma 4 31B	Google	Apache 2.0	Effectively unrestricted
GLM 5.3 Flash	Z.AI	MIT	Effectively unrestricted
GLM 5.3	Z.AI	Custom (MIT-based)	Z.AI security review if you run a model-as-a-service business with over $10B in revenue
Kimi K3	Moonshot AI	Custom (MIT-based)	Separate agreement with Moonshot if such a business exceeds $20M in revenue
Nemotron 3.5 Lightning	NVIDIA	OpenMDW 1.1	NVIDIA's open-model license
MiniMax M3	MiniMax	Custom (community)	Read the text

The Kimi K3 and GLM 5.3 conditions target businesses that resell the model itself as an API, what the licenses call "Model as a Service". Running an agent for your own work will almost never trigger them. But "almost never" is not a reason to skip the text. Each license is about two pages long.

The second misunderstanding is "open-weight means my data stays home". The weights being public says nothing about where you run them, and there are three options. Send requests to an inference provider (Fireworks, Together, Nebius Token Factory, or in Japan, Sakura's AI Engine). Run the model on your own PC with Ollama or LM Studio. Run it on your own GPU server with vLLM. Each choice sends your data to a completely different place. Hermes supports all three: its provider list includes hosted services such as Fireworks, Nebius Token Factory, Hugging Face and NVIDIA NIM alongside local runtimes such as Ollama, LM Studio, vLLM and llama.cpp⁸. This article starts with the hosted route and uses Fireworks as the example.

Who Fireworks AI is, and where your data goes

Fireworks AI is a US company that specialises in inference and training for open models. On July 15, 2026 it announced a $1.505 billion Series D at a $17.5 billion valuation. The same post said the company had passed $1 billion in annualised revenue and was serving more than 40 trillion tokens a day, over 95% of them from models specialised on customers' own data⁹. Its self-description is not "we rent you a general model" but "we help you own your own".

Prices are on the official pricing page per million tokens, listed as input, cached input and output. Here are the headline models as of September 12, 2026¹⁰.

Model	Input	Cached input	Output
Kimi K3	$3.00	$0.30	$15.00
Kimi K2.6	$0.95	$0.16	$4.00
DeepSeek V4.1 Flash	$0.22	$0.007	$0.66
DeepSeek V4 Pro (0813)	$1.32	$0.044	$3.96
GLM 5.3	$1.40	$0.26	$4.40
GLM 5.3 Flash	$0.15	$0.03	$0.50
Qwen 3.8 Max	$2.00	$0.25	$6.00
gpt-oss-120b	$0.15	$0.015	$0.60
Nemotron 3.5 Lightning 30B	$0.05	$0.01	$0.20

Against Claude Opus 5 at $5 in and $25 out, which I checked in the previous article, DeepSeek V4.1 Flash is about 23 times cheaper on input and 38 times cheaper on output. The capabilities are not the same, obviously. But much of what an agent does in the background, reading files, summarising test output, and so on, does not need the top model. Batch inference is half price, and new accounts get $1 of free credit¹⁰.

Now the safety side. Fireworks' documentation states "Zero Data Retention" as the default: for open models, prompts and generations are not logged and not written to persistent storage unless you explicitly opt in. Data exists only in volatile memory for the duration of the request, and a few minutes longer when prompt caching is on¹¹. There is one exception. If you use the OpenAI-compatible Response API, store=True is the default and conversations are kept for 30 days. Pass store=False and nothing is kept, and a delete endpoint removes records immediately¹¹. Hermes normally connects through the Chat Completions format, so this does not apply, but keep it in mind for other tools.

On certifications, Fireworks states on its own site that it holds ISO 27001, ISO 27701 and ISO 42001, along with SOC 2 Type II and HIPAA support¹². I will leave that as "Fireworks says so". We have not audited them. Before you sign anything, ask for the certificates and audit reports through their Trust Center.

And now the point I most want to make. Zero data retention and where your data is processed are two different things. Fireworks' region list includes several US states, Frankfurt, Iceland, Malaysia, Sydney, and Tokyo (AP_TOKYO_1 with H100s, AP_TOKYO_2 with H200s)¹³. But that list is for dedicated deployments, where you rent your own GPUs, and single regions require a request and a quota grant. The serverless inference everyone actually uses is, by default, spread across the global fleet. For customers who need a fixed processing location there is "US-only Serverless" at us.api.fireworks.ai, which serves Kimi K3, DeepSeek V4 Flash, GLM 5.3 and others exclusively from the US, at a 50% premium over base price from September 1, 2026¹⁴. EU-only means talking to sales. Japan-only serverless does not exist. If you want Tokyo, you need a dedicated deployment, and region-restricted deployments cost 1.5 times the standard rate¹⁰.

So "Fireworks keeps it in Japan" is wrong, and "Fireworks states it does not train on or store your data, but processes it worldwide" is right. As I wrote in Can you run an LLM in a Japanese region?, region selection has moved from a settings toggle to a line item. With that in mind, the decision becomes which data you send to Fireworks and which you do not. That is the last section.

Step by step: from install to a Fireworks connection

Here is the actual procedure, following the official Quickstart¹⁵. Allow about thirty minutes if you have not done this before.

1. Install. On macOS and Windows the recommended path is the Hermes Desktop installer from the official site. If you only want the command line, on macOS, Linux or WSL2 run this one line in a terminal.

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

On native Windows, run iex (irm https://hermes-agent.nousresearch.com/install.ps1) in PowerShell. The installer brings in uv, Python 3.11, Node.js, ripgrep and the rest. When it finishes, reload your shell with source ~/.zshrc (or .bashrc)².

A word for corporate machines: "download a script from a URL and run it" may itself breach your internal policy. If so, download the script, read it, then run it, or ask your IT department. That applies to every tool of this kind, not just Hermes.

2. Set your Fireworks API key. Create a key in the Fireworks console and register it with Hermes. Secrets go to ~/.hermes/.env and ordinary settings to ~/.hermes/config.yaml, and the following command writes to the right file automatically¹⁵.

hermes config set FIREWORKS_API_KEY fw_xxxxxxxx

3. Pick a model. hermes model opens an interactive menu. Choose "Fireworks AI" and pick from the live catalog. Fireworks model names use a slash-separated form such as accounts/fireworks/models/kimi-k2p6⁸. To specify it directly:

hermes chat --provider fireworks --model accounts/fireworks/models/kimi-k2p6

One caveat. Hermes requires a model with at least 64,000 tokens of context and rejects smaller ones at startup¹⁵. The main Fireworks catalog models are fine; local models, covered later, need explicit configuration.

4. First conversation. Start with hermes (or the newer hermes --tui) and give it something easy to verify, like "summarise this folder in five lines". Success looks like this: the model name shows at the top, you get a reply without errors, and the agent can use a tool such as reading a file. Also confirm that hermes --continue resumes the previous session¹⁵.

5. Switch models, and set up a fallback. Type /model mid-conversation to switch among the providers you have configured. The whole point of this setup is that you can use cheap DeepSeek V4.1 Flash for everyday work and Kimi K3 for hard design questions. Add a fallback_providers list to config.yaml and, when the primary model hits a rate limit or an outage, Hermes swaps to the backup without losing the conversation⁸.

If you would rather use Together AI or Japan's Sakura AI Engine than Fireworks, register it as a custom endpoint. Any server that exposes an OpenAI-compatible /v1/chat/completions works, and the docs include a Together AI recipe⁸.

# ~/.hermes/config.yaml
providers:
  together:
    api: https://api.together.xyz/v1
    key_env: TOGETHER_API_KEY
model:
  default: MiniMaxAI/MiniMax-M2.7
  provider: custom:together

Sakura's AI Engine offers an OpenAI-compatible API hosted in Japan and connects the same way. It serves gpt-oss-120b at 15 yen per million input tokens and 75 yen per million output tokens, which I covered in the previous article as the option that keeps everything domestic¹⁶.

The settings that make it safe. This is the real subject

An agent does not just chat. It acts. It rewrites files, runs commands and goes out to the web. Get the settings wrong and the damage is nothing like a bad chat answer. In December 2025 OWASP published its "Top 10 for Agentic Applications 2026", which names ten risks specific to agents: goal hijack (ASI01), tool misuse (ASI02), privilege abuse (ASI03), supply chain (ASI04), unexpected code execution (ASI05), memory poisoning (ASI06) and so on¹⁷. It sounds abstract. Mapped onto Hermes' settings, it becomes quite concrete.

First, one thing that actually happened. On July 30, 2026, Palo Alto Networks' Unit 42 reported that a Chinese-speaking threat actor had combined Hermes Agent with DeepSeek, issued instructions over Telegram, and let the agent autonomously attempt exploits against more than 460 targets¹⁸. Hermes and DeepSeek are legitimate open-source tools; this is a knife being used for something other than cooking. What caught my attention was how it was discovered. The attacker's own agent started a file server in its home directory and exposed the whole environment to the internet: config files, API keys, target lists, session logs. That is how Unit 42 found it¹⁸. An agent does what it is told, exactly as told, and sometimes more than it was told. The lesson for defenders is simple: decide up front what the agent can reach and which keys it can hold.

Hermes' security documentation is built on that idea and describes eight layers¹⁹. Here are the ones a beginner should set, in order.

Leave approval mode on smart. Never use --yolo. Hermes asks for human approval before dangerous commands. In the default smart mode an auxiliary model rates the risk: low-risk commands such as python -c "print('hello')" are auto-approved, genuinely dangerous ones are auto-denied, and only the uncertain ones come to you. The --yolo flag, the /yolo command and HERMES_YOLO_MODE=1 skip all of this, and a red warning stays on screen the whole time. Do not use it outside a disposable environment running well-tested automation. Note that rm -rf /, fork bombs, direct disk writes and piping a downloaded URL straight into a shell sit on a "hardline blocklist" that refuses to run even under YOLO or with approvals off¹⁹. Unattended cron jobs that hit a dangerous command are denied by default (cron_mode: deny). Leave that alone too.

Isolate the terminal in Docker. This is the single most effective setting. Run hermes config set terminal.backend docker and the agent's commands execute inside a container instead of on your host. The official container drops every Linux capability (--cap-drop ALL), forbids privilege escalation, caps the process count at 256 and restricts writes to /opt/data¹⁹. The comparison table in the security doc describes local as "None — runs on host" and docker as "container is boundary". My recommendation: try local first to get a feel for it, then switch to docker before the agent touches any company data.

Keep real keys out of the sandbox. Even inside Docker, if the container holds your real API key, a prompt injection that gets the agent to run printenv | grep -i key will exfiltrate it. Hermes closes this with the "egress proxy": the sandbox only ever holds opaque placeholder tokens, and a proxy on the host intercepts outbound traffic and swaps in the real credential²⁰. Enable it with hermes egress setup and hermes egress start. As of September 2026 it works with the Docker backend only. Also, terminal.docker_forward_env is empty by default; anything you list there becomes readable inside the container. Do not put API keys in it because it is convenient¹⁹.

Decide where it cannot write. Before write_file or patch touches disk, Hermes checks the target against a denylist. ~/.ssh/, ~/.aws/, ~/.kube/, /etc/sudoers, ~/.netrc and any .env-style file in a project are always refused, with no approval prompt at all. Set HERMES_WRITE_SAFE_ROOT and nothing outside that directory can be written¹⁹. The docs add an honest note: the model may still claim the edit succeeded, so trust the verification footer at the bottom of the screen rather than the assistant's summary.

Limit where it can go. Web search and browser tools refuse private addresses by default, including internal networks and cloud metadata at 169.254.169.254, and fail closed when DNS does not resolve. Setting security.allow_private_urls to true lifts this, and the docs warn never to do that on a public-facing gateway. website_blocklist lets you ban specific hosts such as your admin panels¹⁹.

If you use Telegram or any messaging gateway, an allowlist is mandatory. Gateways are convenient, but "anyone can message it" means "anyone can run commands on your machine". Never set GATEWAY_ALLOW_ALL_USERS=true in production, register users with pairing codes, run as non-root, and chmod 600 your ~/.hermes/.env. That is the order the official deployment checklist uses¹⁹.

Watch the supply chain. Skills, plugins and MCP servers are other people's code and instructions loaded into your agent. Hermes runs a security scan on hermes skills install, applies tier-1 scanning to plugins, and its changelog records removing the "Blender MCP" catalog entry and skill after an upstream compromise³. It also refuses to load AGENTS.md-style instruction files that show signs of prompt injection, and warns at startup if the environment contains a known-poisoned package version, using the May 2026 mistralai poisoning as its example¹⁹. For a user this boils down to two habits: run hermes update regularly, and do not ignore what hermes doctor tells you.

One quieter feature deserves a mention. Since v0.21.0, every model picker warns you when the selected model is of a kind that trains on user data³. Such models exist; Meta's "contributor" tier trades a lower price for the right to train on your prompts⁸. When the warning appears, do not pick that model for anything confidential. That alone prevents a whole class of incidents.

Which data, and how far

With the settings covered, the last part is judgment. You are probably still asking "so can I send company data to Fireworks or not?" My answer is: split it by type.

Type one is public information and data you could afford to leak. Summarising published technical documents, reading open-source code, general research. Global serverless on Fireworks is fine for this. There is a zero-retention statement, and the price is a fraction of a top-tier model. There is no reason to pay for the expensive model here.

Type two is ordinary internal data. Meeting notes, internal procedures, documents without customer names. This is a policy call, but whoever makes it should at least know that processing is spread worldwide. If you need to keep it inside the US, US-only Serverless is available at a 50% premium¹⁴. If a customer contract has a clause about processing location, that clause is your answer.

Type three is confidential data. Drawings, unpublished financials, personal data, anything a business partner entrusted to you. My position is that this should not go to global serverless. The reason is less the law than counterparty audits, contracts, and the asymmetries I described in Can foreign governments reach data on overseas servers?. Three options. Stand up a dedicated deployment in Fireworks' Tokyo region, at 1.5 times the price and with a quota request. Use a domestic inference service such as Sakura's AI Engine that keeps everything in Japan. Or run it on hardware you control, such as Ricoh Japan's kit or an NVIDIA DGX Spark. According to NVIDIA's blog, Qwen 3.6's 35B model runs in about 20 GB of memory, and a DGX Spark with 128 GB of unified memory can keep a 120-billion-parameter model running all day⁶. Hermes supports Ollama and LM Studio out of the box, so the configuration is not the hard part⁸.

The weaknesses of running locally are the ones I listed last time: web search and tool quality, response speed, and the time of whoever operates it. Honestly, if you push non-confidential work onto local models too, people stop using the agent because it feels slow. Hence the split. One Hermes instance, and a single /model command to move between a cheap external model and a domestic one. That is the setup I find most realistic today.

This split, run as an organisational policy rather than personal discipline, is also what we are building with ZEROCK. A gateway sits between the agent and the models, and one place decides, by data classification, whether a request stays in Japan or goes abroad and which model handles it. Users point base_url at it and keep using Hermes or any other open-source agent as before. Implementing company policy as configuration, instead of trusting each user's good sense, is what enterprise use of open-weight models requires. See the ZEROCK page for details.

Wrapping up

Hermes Agent is free, model-agnostic and runs anywhere. Add the word "safely" and the to-do list becomes clear. Leave approval mode on its default. Isolate the terminal in Docker. Hide your real keys behind the egress proxy. Put an allowlist on any gateway. Keep it updated. And understand that Fireworks' zero data retention means "we do not train on it or store it", not "we process it in Japan", then route each class of data accordingly.

If you do one thing today: on your own laptop, with public data only, leave the backend on local and spend an hour with it. Once you have a physical sense of what the agent does, switch to docker, then let it near company data. Keeping that order prevents most of the accidents I have seen. If you want to design the boundary between open-weight models and your internal data together, let's talk through a consultation.

Footnotes

1. Ricoh Japan adds the self-improving AI agent "Hermes Agent" to the edge model of the RICOH On-Premises LLM Starter Kit (Ricoh Japan Co., Ltd., September 10, 2026, in Japanese) ↩ ↩²

2. NousResearch/hermes-agent README (GitHub, retrieved September 12, 2026: 244,608 stars, 50,705 forks, MIT) ↩ ↩² ↩³ ↩⁴ ↩⁵

3. Hermes Agent Releases: v0.21.0 (August 31, 2026) and v0.21.2 (September 11, 2026) (GitHub) ↩ ↩² ↩³

4. Hermes agent maker Nous Research in talks for new funding at $1.5B valuation (TechCrunch, July 13, 2026) ↩

5. Nous Portal — Plans (Nous Research, retrieved September 12, 2026) ↩

6. Hermes brings self-improving AI agents to NVIDIA RTX PCs and DGX Spark (NVIDIA Japan Blog, May 22, 2026, in Japanese) ↩ ↩²

7. Hugging Face model cards and LICENSE files (retrieved September 12, 2026): deepseek-ai/DeepSeek-V4-Flash-0731, Qwen/Qwen3.8-27B, openai/gpt-oss-120b, google/gemma-4-31B-it, zai-org/GLM-5.3 LICENSE, moonshotai/Kimi-K3 LICENSE, nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16 ↩

8. LLM and Model Providers — Hermes Agent Docs (Nous Research) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

9. Announcing our Series D and $1B ARR (Fireworks AI, July 15, 2026) ↩

10. Serverless Pricing (Fireworks AI Docs, retrieved September 12, 2026) and Pricing (Fireworks AI) ↩ ↩² ↩³

11. Zero Data Retention — Data retention policies at Fireworks (Fireworks AI Docs) ↩ ↩²

12. Data Security (Fireworks AI Docs) ↩

13. Regions (Fireworks AI Docs) ↩

14. US-only Serverless (Fireworks AI Docs) and Data residency (Fireworks AI Docs) ↩ ↩²

15. Hermes Agent Quickstart — Hermes Agent Docs (Nous Research) ↩ ↩² ↩³ ↩⁴

16. Sakura AI Engine (SAKURA internet, in Japanese) ↩

17. OWASP Top 10 for Agentic Applications 2026 (OWASP Gen AI Security Project, December 2025) ↩

18. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (Palo Alto Networks Unit 42, July 30, 2026) ↩ ↩²

19. Security — Hermes Agent User Guide (Nous Research) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

20. Egress credential-injection proxy (iron-proxy) — Hermes Agent Docs (Nous Research) ↩