Hermes Agent Review: Nous Research's Self-Improving AI Agent

Imagine this scenario*: you’ve been using the same AI coding agent for three months. Every morning you explain the same codebase conventions, the same branching rules, the same deploy gotchas.* Every afternoon it forgets. You’ve written a 400-line CLAUDE.md and pinned it to the system prompt. The token bill keeps climbing, the agent keeps asking where the tests live, and every new session is week one of onboarding, forever.

This is the memory problem that every agent framework in 2024 and 2025 was supposed to solve, and none of them did. Most shipped a vector database, called it “long-term memory”, and moved on.

Then Nous Research released Hermes Agent on February 25, 2026. Seven weeks later it crossed 95,000 GitHub stars. At the time of writing it sits around 105,000, making it the fastest-growing open-source agent framework of the year. The reason is not the star count. The reason is that it’s the first agent framework I’ve looked at where “learning” means something I can verify by reading a file on disk.

This article covers why Hermes Agent matters right now. I’ll walk through how the skill-creation mechanic works so you can judge whether “self-improving” means something mechanical or something marketing, how the three-layer memory model differs from the vector-DB-plus-scratchpad pattern every competitor shipped last year, how the deployment model changes what you’d actually use an agent for, where I’m skeptical that the design survives contact with regulated workloads, and whether it’s worth pulling into a real engineering workflow this quarter.

What Hermes Agent actually is

The tagline on the repo is “the agent that grows with you”. The description that survives contact with reality is this: Hermes Agent is a Python-first, MIT-licensed agent framework that runs on top of 200+ models via OpenRouter, Nous Portal, NVIDIA NIM, OpenAI, or a custom endpoint. It ships a terminal UI, a cron scheduler, isolated subagent spawning, and six messaging integrations (Telegram, Discord, Slack, WhatsApp, Signal, and plain CLI) out of the box.

Install is a one-liner on Linux, macOS, WSL2, and Android via Termux:

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

None of that is why it’s trending.

The reason it’s trending is one design choice. After a complex task finishes, defined as five or more tool calls, the agent writes a skill document. A skill is a Markdown file that captures the approach it took, the edge cases it hit, and the domain knowledge it had to reconstruct to finish the job. Next time a similar task arrives, the agent loads the relevant skill instead of reasoning from scratch.

The current release, v0.10.0 (April 16, 2026), ships with 118 bundled skills. The interesting ones are the ones you accumulate.

The learning loop, in mechanical terms

very framework I’ve evaluated in the last eighteen months has claimed to have memory. In practice, “memory” almost always meant one of two things: a RAG pipeline over past conversations, or a scratchpad the model is told to write into and then ignored. Hermes Agent’s loop is structurally different.

After a task finishes with five or more tool calls, a background process summarises the trajectory into a Markdown skill file with a YAML frontmatter header. The skill is plain text on disk. You can read it, edit it, delete it, commit it to git. It’s the same pattern that made CLAUDE.md files useful, except the agent writes them, not you.

At intervals the agent gets prompted to decide whether something it just learned should be persisted. The decision of what to keep is the part most “memory” implementations skip. If you don’t decide, everything is equally important, and “everything is important” is the state vector databases are already good at.

Past conversations are indexed with SQLite FTS5. The agent searches its own logbook by keyword, not by embedding similarity. This sounds unsophisticated. In practice it’s more reliable than a vector search for the one thing the agent actually needs, which is finding the session where it solved this exact problem before. Embedding similarity is good at “find me something related to X”. Keyword FTS is good at “find me the time I fixed the exact bug I’m looking at”. Those are different queries.

On top of that, a user model built via Honcho maintains a profile of what stack you use, what abbreviations you prefer, and what you’ve already been told. Together those four layers are what the project calls the learning loop.

The claim I’ve been able to verify from the repo and third-party benchmarks is that self-created skills cut research-task time by about 40% versus a fresh agent instance on the same job. TokenMix published the number; I haven’t rerun the benchmark myself. Treat 40% as directional, not a load-bearing fact.

The part most of the coverage misses

Almost every review I’ve read focuses on the skill loop and the messaging integrations. The part I think actually matters is the deployment story.

Hermes Agent decouples where it runs from where you talk to it. Six terminal backends ship in the box: local, Docker, SSH, Daytona, Singularity, and Modal. You can talk to the agent from Telegram on your phone while it executes on a Modal serverless worker that costs nearly nothing when idle. You can run it on a $5 VPS that stays up when your laptop is closed. You can pin it to an SSH backend that runs inside a customer’s VPC for a consulting engagement.

This is a different shape from Claude Code, Cursor, and Aider, which assume the agent and the human share a terminal. The practical consequence is that tasks that need patience, like “watch this repo and file an issue when the test suite starts flaking”, become tractable. The thing watching doesn’t have to be your local process.

For a backend engineer this is the feature that changes the workflow, more than the skill loop does. The skill loop is why the agent gets better over time. The deployment flexibility is why you’d leave one running.

Where I’m skeptical

A few things, in decreasing order of severity.

Skill quality is an open question

A Markdown file written by an LLM summarising what it just did is only as good as the LLM’s self-observation. The 118 bundled skills have been human-reviewed. The ones your agent accumulates have not. In practice the median user will collect a handful of excellent skills, a pile of mediocre ones, and at least one that confidently codifies a wrong approach. Skill review (pruning, editing, promoting good ones, deleting bad ones) is going to become a real discipline if this pattern catches on.

FTS5 is fast, not semantic

The session search is a keyword index. If your past solution used different terminology than your current problem, it won’t surface. This is a feature in the “predictable and debuggable” sense, and a limitation in the “the agent should be smarter than grep” sense. I suspect a hybrid index lands before the end of the year.

The learning loop is expensive

Skill extraction runs an LLM over the trajectory. Memory nudges run an LLM over the context. User modelling runs an LLM over the profile. On a $5 VPS with a cheap model behind it, this is fine. On a frontier model via API, the bill for the meta-cognition can exceed the bill for the work. The 200+ model support is not a flex; it’s an admission that you probably want a cheap model doing the housekeeping.

Auditability is not yet part of the story

For anything regulated (fintech, healthcare, legal), “the agent learned that” is not an acceptable answer to a compliance question. There’s no signed skill provenance, no immutable log of what got promoted when, no approval workflow. This is fixable. It isn’t fixed.

Security concerns nobody is writing about yet

Every review I’ve read has treated Hermes Agent as a productivity story. The security story is more interesting, and more awkward. If I had to rank my worries, I’d put skill poisoning at the top and work down from there.

Skill poisoning is prompt injection with a save button

Prompt injection writeups for the last two years have focused on single-turn attacks: a malicious webpage, a crafted email, a poisoned search result. Hermes Agent introduces something worse. If the agent can be injected once during a session, and that session produces a skill, the injection persists on disk as a Markdown file. The next time the agent picks a related task, it loads that skill as trusted context and follows the instruction. Memory-poisoning research has flagged this pattern since 2024; Hermes is the first popular framework where it’s the default behaviour.

The mitigation story hasn’t been written. Skill files carry no signed provenance. There’s no observable difference between “a skill the agent wrote” and “a skill I dropped into the directory”. Your defence is whatever review process you personally impose, on every skill, forever.

The $5 VPS runs with your credentials, not the agent’s

The deployment flexibility is a feature. It’s also a threat model. A VPS running Hermes Agent probably has SSH keys, cloud credentials, a GitHub PAT, and whatever secrets your cron jobs need. The agent can read those. The agent can be steered into reading those. If you’ve wired Telegram as a chat channel, anyone who obtains the bot token can converse with the agent, and the agent converses with whatever’s in your environment.

Command approval helps until it doesn’t. Every “click OK to proceed” system eventually becomes “auto-click OK”.

MCP servers are the new npm supply chain

Hermes Agent supports MCP tool integration. Every MCP server you install is code executing with the agent’s authority. There’s no signing, no sandbox, and the discovery surface (a GitHub search, a Slack thread, a blog post) is the same surface that made npm a decade-long supply chain problem. The day somebody publishes mcp-everything-super-useful and half the Hermes Agent user base installs it, you find out how fast a poisoned MCP can reach 50,000 dev machines.

The session index is a searchable archive of your secrets

FTS5 indexes every past conversation. If your sessions touched production, and sessions that need an agent usually do, your session database holds whatever the agent read while executing: API keys, customer records, stack traces with payloads, PII that slipped through. It’s a useful feature and a compliance liability. An attacker who gets file-level access to the Hermes Agent data directory gets a full-text-indexed history of every task you’ve run, with a query interface built in.

User modelling and the erasure problem

The Honcho user model maintains a profile across chat platforms that deepens over time. That’s useful until the day a customer exercises their right to erasure under GDPR Article 17, or a DSAR lands involving someone who got mentioned in a task you ran. The EDPB has not issued definitive guidance on how this kind of derived profile qualifies under erasure requests. Some DPAs treat profile data as regulated personal data; others argue the derived profile sits in a grey area. Either way, “delete the user model cleanly” is not an operation the framework currently exposes. If you’re shipping anything that touches EU data, this is a conversation to have with your DPO before the feature starts being useful to you.

Where it fits today

Hermes Agent is a strong fit if you want an always-on personal agent that accumulates competence, runs somewhere other than your laptop, and reaches you through the chat app you already use. For solo developers, indie hackers, and researchers running long experiments, the deployment model plus the learning loop is a real productivity shift.

It is not yet a fit for regulated backend engineering workflows. The skill format is open and inspectable, which is good, but the production concerns listed above (signed provenance, approval workflows, audit trails) and the threat model from the security section (skill poisoning, MCP supply chain, credential exposure on the host) are both unresolved. I wouldn’t point it at a payment processing codebase this quarter.

It’s also worth saying out loud: this is open-source infrastructure from Nous Research, not a managed product. You’re running it. You’re reviewing the skills it writes about your codebase. You’re deciding what it’s allowed to do. That’s the deal with every agent framework worth using, and Hermes Agent is more honest about it than most.

What I’d watch next

A few things will tell us whether Hermes Agent is a durable shift or a trend spike.

The companion project, hermes-agent-self-evolution (ICLR 2026 Oral, MIT), applies DSPy + GEPA to optimise skills, prompts, and the agent’s own code against benchmarks. If that feedback loop produces measurable compounding improvement on public evals, the “self-improving” tagline becomes defensible. If the gains plateau after a few iterations, the learning loop is a better UX, not a better algorithm.

The skill ecosystem is the other question. 118 bundled skills today. The question is whether a skill registry emerges, with versioning, signing, and curation. If Hermes Agent’s skills become a portable artifact (the way Claude Code plugins and Cursor rules are becoming), the framework has network effects. If every user accumulates their own private drawer of skills and never shares, it stays a personal tool.

And an enterprise fork is almost inevitable. Someone, possibly Nous, possibly a third party, will cut a commercial distribution with signed skills, audit logs, role-based approval, and a control plane. When that lands, the question of whether regulated workloads can use this pattern gets a real answer.

What I’d do Monday morning

If you have a long-running side project and you’ve been using Claude Code, Cursor, or Aider in the default configuration, install Hermes Agent on a $5 VPS this week. Point it at one repo. Give it a Telegram channel. Let it accumulate skills for a month. Read the skills it writes. Delete the ones that are wrong. Keep the ones that save you time.

If you’re running agent work for a team, wait. Watch the self-evolution numbers. Watch for the enterprise fork. The learning loop is the right idea; the operational surface isn’t there yet for code that matters.

I’ve spent the last eighteen months watching agent frameworks ship memory features that weren’t memory. Hermes Agent is the first one where “the agent learned that” points to a file I can open and read. That’s a low bar, architecturally. It’s also the bar every previous framework failed.