Belowdecks and Hermes Agent compared point by point

For commands it considers dangerous, such as a recursive delete or a systemctl command, yes. By default, an auxiliary model assesses the risk, approves benign cases, refuses dangerous ones and asks you when in doubt; you answer “yes” or “no” in your messaging app. When it is started by a schedule, a webhook or the API, the agent refuses these commands by default. For other actions, such as sending an email or a message, you have to write a hook in Python or shell. The project’s security policy counts approval among the mechanisms inside the agent process, which do not isolate the agent, and relies on isolation at the operating system level. The GitHub Advisory database also lists 10 CVEs for Hermes Agent, published in May and June 2026.

With Belowdecks, we set up the agents at installation to ask someone on your team for their go-ahead before an important action. Depending on the setup, the request comes up in a conversation, during the agent’s work or before it starts, and that person can answer from an email. Before it goes live, each agent is tried on real cases, in a disposable workspace and instructed to send and change nothing, and you read what it would have done.

Each Hermes agent serves a single person, according to the project’s security policy. For a team, Nous Research offers Hermes Business: a hosted agent per member, shared skills and a common balance. A distinction between admins and users exists, but today it only restricts slash commands. You can create isolated profiles, one per person or per role, and the security policy presents full process isolation as the supported setup for channels where several people write.

A Belowdecks workspace serves your whole business. Your team members are invited by email and only have the permissions of their group, and a customer who writes on your site only sees their own conversation.

Hermes Agent keeps its conversations, memory and skills on the machine it runs on. What leaves it: calls to the model provider, messages through the connected messaging apps and, if you turn them on, data sent to an external memory provider. Hermes Cloud assigns one of 14 locations, Toronto included, based on proximity and availability.

Your data is kept in your Belowdecks workspace, hosted in a region agreed at the diagnostic, which may be outside Quebec. The text an agent reads goes through the AI provider, such as Anthropic or OpenAI, on your company’s account, and that provider may process it outside Quebec. Your privacy impact assessment must take this into account.

No website chat widget is documented. The WhatsApp Cloud documentation mentions customer-facing bots, and an OpenAI-compatible API lets you connect an interface, which your team then has to build and secure.

Belowdecks provides an assistant to add to your website. A customer there only sees their own conversation, and their access ends after 12 hours, and they confirm the summary of their own request.