Hermes Agent v0.21.0 Makes the Fleet Visible

Nous Research shipped Hermes Agent v0.21.0 on August 31, 2026, under the CalVer tag v2026.8.31. The project calls it the Pantheon Release. AgentRiot last covered Hermes at v0.20.0 Herald on August 3. The 0.20.1 through 0.20.6 patch tags sit in this cut; the notes say those windows were deferred here on purpose.

Herald made Hermes something other software could call: Agent2Agent, signed webhooks, interruptible voice. v0.21.0 is about running a fleet of those agents as a team you can see. The spine is Bot Mode, now built into the desktop app and on by default.

The release notes report roughly 5,800 commits, 2,475 merged pull requests, and 2,100 closed issues since v0.20.0. GitHub’s compare for v2026.8.3...v2026.8.31 returns ahead_by 6,107. Treat both as project and API counts, not an independently reconstructed ledger. The volume is noise. Multi-agent work moved out of YAML and into a roster.

A bot is still a profile

Bot Mode does not invent a new runtime. A Bot is a Hermes profile: isolated config, memory, skills, credentials, and history under ~/.hermes/profiles/<name>/. The desktop renders that primitive as a roster with faces. hermes -p <bot> chat is the same agent. Routines show up in hermes cron list.

Every profile gets a name, a deterministic blob-face avatar (with randomize, lock, and silhouette controls), and a canonical Bot Chat that is created and pinned when the bot is born. Inside that chat, /new is rerouted to /compact so the relationship is not forked into a scratch session. Regular sessions on the same profile keep /new. That is a product decision: a specialist that forgets itself every morning is just another window.

You can @-mention bots from the composer. Group chats are Discord-style rooms in the same roster. Docs cap a room at 2–6 bots, three serial rounds, and 10 messages per send. Members can pass instead of talking. A bot can escalate to you with @user, which lights a needs-you badge. Rooms can span machines if Desktop has multiple connections registered; same-named agents disambiguate as @name-device.

The important limit is documented: bot-to-bot delivery is per-invocation. Live interrupt of a bot mid-conversation is future work.

Two ways bots talk across machines

Local DMs use message_agent inside canonical Bot Chats. Delivery is fire-and-forget: the sender gets an acknowledgement, and the reply arrives later as a background completion. The receiving bot composes its own message; your text is not forwarded verbatim.

Across machines there are two routes.

Desktop as courier: while Desktop holds sockets to two gateways, it relays message_agent traffic. If Desktop closes mid-delivery, the sender is told the reply did not arrive.

hermes peer: register another gateway’s API server URL and API_SERVER_KEY, then hermes peer dm or peer run with no Desktop in the loop. NAT still matters. A laptop can dial a public VPS; the reverse needs Tailscale, a VPN, or a public inbound path.

Both are more honest than pretending every agent on the LAN can always reach every other agent.

Cron stopped being a goldfish

Scheduled jobs used to hard-deny memory. PR #91447 flips that: cron agents load MEMORY.md and USER.md and keep the memory tool unless the user denylists it.

That is separate from session amnesia. Cron still starts a fresh session each fire. What changed is the durable layer, plus two explicit flags.

continuity=true injects the job’s own previous output so a scout can dedupe. That behavior is in the cron guide. Monitor and no_agent jobs skip the model when the script’s stdout is the whole message, or when a hash says nothing changed.

Cron output can also land in a bot’s canonical Bot Chat (deliver=bot-chat), where the bot actually responds (#91487). A 9am briefing that can see yesterday’s brief, and can talk to the research bot instead of dumping into a void, is the difference between a timer and a coworker.

Subagents you can steer

delegate_task grew live orchestration: list running children, steer one mid-flight, or stop it and keep the partial result (#85232). Steer queues a course correction at the child’s next iteration boundary; it does not cut an in-flight tool call. A queued response is not proof the child saw the text. If the child finished first, the pending steer is drained into the result so you can tell a steered child from one that ran on the old instructions.

The tagged v0.21.0 source raises defaults to 250 iterations and 10 concurrent children (#86506, #86745). The live docs page still described the older 3 / 50 figures when checked on September 2. Trust the tagged source over the stale page.

Optional JSON-schema validation on child output, and per-delegation cost in the result, are the parts that make fan-out reviewable. Kanban also picked up collision-hotspot flagging and a split-brain decision-ownership contract. None of that is a spend cap. Ten children will still burn tokens. The change is that you can notice and redirect before the batch finishes wrong.

The desktop becomes a control surface

Three other desktop changes matter because they remove config-file archaeology.

MCP servers and the catalog are one page, with paste-anything import, background health checks, schema-token estimates, and hermes:// install links that still require confirmation (#87525).

The agent can drive the in-app browser, not just look at it (#90197). Pages can pop out to the system browser.

The CLI gained a Ctrl+P command palette, type-to-filter /model, a richer /status, and live cache-hit / latency / tokens-sec in the status bar. Detached update hand-off is the one operators will feel: quit, update, reopen, including a Windows path that no longer parks on “Updating Hermes.”

The catalog also added providers (Meta Model API / Muse Spark, CommandCode, Tencent TokenPlan, Nebius Token Factory, Ramp Router, Actual Computer) and a model_overrides config so you can patch a model’s context window or pricing without waiting on a release. A model in a catalog is not a performance claim.

Telegram users get an inline picker that searches commands and skills via @botname, which bypasses Telegram’s command-menu cap (#98317).

Security is the other half of a fleet

A society of bots is also a larger attack surface. v0.21.0 makes writes to protected instruction files (AGENTS.md, skills, memory stores) always require approval, so a prompt-injected agent cannot quietly rewrite standing orders (#81152). A redaction sweep closed leak paths across .env reads, terminal errors, checkpoints, and ACP logs. Destructive Windows commands now trip approvals. macOS permission grants can survive updates via a stable TCC signing identity (hermes desktop --setup-tcc-identity).

The project also removed the Blender MCP catalog entry and skill after an upstream compromise. That is a supply-chain response, not a feature.

What did not ship

The release is explicit about reverts. Model Council (/council) and the DCP context engine landed and were pulled. A WS-only gateway server merged and was reverted; FastAPI remains on the desktop boot path. Seq-stamped event replay did ship.

Those cuts matter. A several-thousand-commit window that pretends nothing was withdrawn is marketing. This one names the withdrawals.

Update path

Nous announced the cut on X and pointed at hermes update. Installers remain the documented one-liners on the docs homepage.

PyPI’s project JSON still listed 0.19.0 as the latest package when checked on September 2. Do not treat pip install hermes-agent as this release. The GitHub tag and hermes update are the path.

Hermes Agent remains MIT-licensed. A visible team is easier to run than a pile of profiles. It is also easier to over-permission. Bot Mode will not save a fleet whose skills, MCP servers, and write approvals were never tightened.