Contents
I gave an AI agent terminal access to my Mac mini, connected it to WhatsApp, and then asked it to post on X. It installed the missing CLI, discovered there was no authenticated account, tried the browser, hit another login wall, and stopped.
Then I asked it to log into Google Ads. Same result: it opened the right page, found no saved Google credential, refused to accept a password over WhatsApp, and carried on with the parts of the job it could do safely. It audited the target website, found the existing analytics tag and lead endpoint, spotted missing conversion tracking, and wrote the campaign plan.
Those two failures were more convincing than a clean demo would have been. The agent did useful work right up to the permission boundary, then reported the boundary instead of inventing a success message.
This is my current experiment with Hermes Agent: a local, tool-using agent running on an Apple Silicon Mac mini, reachable from the chat app already on my phone.[1]
What is actually running
The machine runs Hermes Agent v0.21.2 with an OpenAI Codex subscription as the primary provider and gpt-5.6-sol as the default model. Claude Code is separately authenticated through a Claude Max account. Hermes handles the conversation and decides which tool or specialist to use; Claude Code is available when the task is better handed to a coding agent inside a repository.
The Hermes gateway is installed as a macOS LaunchAgent. WhatsApp and Telegram are connected, and a dashboard runs on the same machine. The gateway owns the per-chat sessions, dispatches each message to the agent, delivers files back to the originating chat, and also hosts the scheduler used by recurring jobs.[2]
The current CLI toolset includes browser automation, terminal commands, file editing, Python execution, image generation, vision, text-to-speech, persistent memory, session search, cron, and sub-agent delegation. There are roughly 80 enabled skills layered on top: GitHub workflows, document handling, research, code review, Apple apps, diagrams, spreadsheets, and a long tail of narrower procedures.
A skill is an operating manual, not a credential. Installing the X skill teaches the agent the correct CLI and verification flow; it does not create an X developer application. Installing an email skill does not grant access to a mailbox. I like that distinction because it makes the setup honest: capability and authorization are separate things.
Try it: where does the agent stop?
This is the decision boundary I saw across four real tasks on the machine.
The pattern is consistent. Read-only discovery can proceed. Local edits can proceed inside the agreed workspace. Anything that crosses into somebody else’s system needs the corresponding authorization, and spending or publishing should add an explicit approval of its own.
WhatsApp is a better agent interface than another dashboard
The web dashboard is useful for configuration, but I do not want to visit it every time I need something. WhatsApp changes the relationship with the machine because the interface travels with me.
I can ask for a service check, a repository audit, a document, or a browser task without opening a laptop. The result returns to the same conversation, including generated files and images when the platform supports them. Hermes documents more than twenty messaging surfaces, but the important detail is not the platform count. The same agent, memory, tools, and local machine sit behind each one.[1][2]
The chat is also steerable. If the agent is halfway through the wrong interpretation, a new message can redirect the active turn at the next safe tool boundary. Long work can run in a separate background session and report back later. That feels closer to managing a process than waiting for a chatbot response.[2]
There is a cost to long-lived chats. A WhatsApp conversation can continue for weeks, so the context grows and gets compacted repeatedly. Hermes keeps a small curated memory for durable facts and stores full sessions in a searchable SQLite database. Starting a fresh session at a natural boundary lets the agent reload the compact memory and search the old transcript only when it needs a detail.[5]
The X test: a useful refusal
The X request sounded trivial: post a sentence and tag two accounts.
Hermes first looked for xurl, the official X API CLI. It was missing, so the agent installed it and checked authentication. No application was registered. It then opened X in the automated browser, found a signed-out session, checked the local credential vault, and found no saved login.
At that point there were several bad ways to make the demo look successful. It could have implied the post was queued. It could have asked me to paste a password into WhatsApp. It could have switched to some unrelated personal browser profile and hoped a session cookie existed.
It did none of those. The final answer said the post had not happened and named the missing setup: register the app and complete OAuth once.
This sounds basic, but agent products still blur “I attempted the action” into “the action happened.” For external writes, only a response from the target system followed by a read-back should count as success. The X test never reached that standard, so it remained a failure.
The Google Ads test: finish the safe half
Google Ads produced a more interesting result because the login wall did not make the rest of the task useless.
The agent reached the Google account screen and again found no saved credential. The current conversation was running through the messaging gateway, where a missing website login cannot summon the same secure masked prompt available in an interactive desktop or terminal session. It stopped the login flow rather than moving the password into the chat transcript.
Then it inspected BoxChess, the site I wanted to advertise. Browser automation found the GA4 measurement ID, the fields in the free-trial form, and the /api/submit request used after submission. It also found no Google Ads conversion ID, no dedicated thank-you route, and placeholder Privacy Policy and Terms links.
The resulting campaign plan was based on a useful conversion rather than traffic for its own sake: a successfully submitted free-trial request, followed later by offline stages for a booked trial, attended trial, and paid enrollment. It split search intent between parents looking for kids’ coaching, adults trying to improve their rating, and tournament players looking for deeper analysis.
None of that required access to the Ads account. Keyword Planner estimates, billing, campaign creation, and publication did, so those steps stayed blocked.
This is how I want partial completion to work. A boundary should stop the action that needs permission, not erase all the analysis around it.
Passwords should move without passing through the model
Hermes has a local credential vault designed for browser logins. The user saves a login through a masked prompt in the interactive CLI or desktop app. Hermes encrypts it locally, binds it to the website origin, and fills it directly into the page. The model receives a result saying that a field was filled; it does not receive the password.[4]
The origin check matters. A Google credential saved for https://accounts.google.com cannot be filled into a lookalike domain. Two-factor codes can come from a saved authenticator seed or a separate masked prompt. Passkeys and phone approval still stay with the user.[4]
A saved login can work in a later headless run because no secret needs to be collected at that point. A missing login cannot. That is exactly why the Google Ads task stopped in WhatsApp and why the correct fix is a one-time interactive setup, not a clever prompt.
Terminal access needs harder boundaries than browser access
The browser gets most of the attention, but terminal access is the sharper tool. The agent can run tests, edit files, inspect processes, and invoke other coding agents. It can also do real damage if every command is treated as ordinary text.
Hermes uses layered controls rather than one confirmation checkbox: messaging allowlists decide who can reach the agent; dangerous-command checks gate risky shell operations; protected paths block ordinary writes to credential stores; optional containers isolate execution; and a hard blocklist refuses a small class of catastrophic commands even when normal approvals are disabled.[3]
The default smart approval mode is intentionally uneventful most of the time. A read-only health check should not need a ceremony. A destructive command should. A card fill asks for confirmation, and unattended sessions cannot approve one at all.[3][4]
No local agent is made safe by a list of features. The useful question is what happens after a malicious page, a misunderstood request, or a missing credential. The answer needs to be enforced below the prose prompt.
The part I would automate next
The setup can already do far more than I have reliable routines for. Adding more tools is not the priority.
The next useful loop is boring: check a few services, inspect failed deployments, summarize anything that changed, and stay silent when nothing needs attention. After that, I want qualified-lead reporting for BoxChess and a writing pipeline that drafts on a branch, renders a preview, and waits for approval before publishing.
I also still need to finish the unglamorous setup: authenticate the email MCP server, register the X application, save browser logins in the local vault, add a fallback model provider, and clear the dependency warnings found by the health check.
That unfinished list does not make the experiment less useful. It makes the boundary visible.
My Mac mini is not an autonomous employee, and I do not want it pretending to be one. It is a reachable computer with tools, memory, a permission model, and enough judgment to stop when the next step belongs to me. Right now, that is the agent behavior I trust most.
Sources
[1] https://hermes-agent.nousresearch.com/docs/llms.txt โ Hermes Agent documentation index [2] https://hermes-agent.nousresearch.com/docs/user-guide/messaging โ Hermes Agent messaging gateway [3] https://hermes-agent.nousresearch.com/docs/user-guide/security โ Hermes Agent security model [4] https://hermes-agent.nousresearch.com/docs/user-guide/features/credential-vault โ Hermes Agent passwords and logins [5] https://hermes-agent.nousresearch.com/docs/user-guide/features/memory โ Hermes Agent persistent memory