CowAgent vs Hermes Agent

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

Hermes Agent

Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

Hermes Agent

1. Set approvals.mode: manual before giving it real accounts. The default smart lets an auxiliary model approve commands
2. Run the gateway with terminal.backend: docker or the project's Docker image when it reads mail, web pages or group chats
3. Set memory.write_approval: true and skills.write_approval: true to review what it saves about the owner
4. Leave approvals.cron_mode and approvals.unattended_mode at deny for scheduled and webhook runs
5. Set TELEGRAM_ALLOWED_USERS or the matching allowlist per channel. Never set GATEWAY_ALLOW_ALL_USERS=true