{"slug": "deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent", "title": "Deploy Self-Evolving Agents for Faster, More Secure Research with a Hermes Agent and NVIDIA NemoClaw", "summary": "NVIDIA has released an open-source example integrating Hermes Agent with NVIDIA NemoClaw to enable self-evolving AI agents that securely combine internal and public data for research tasks. The system, enforced by NVIDIA OpenShell, allows agents to learn user preferences and patterns across Slack, Outlook, and GitHub while maintaining security by preventing the agent from accessing the public internet. This deployment pattern aims to accelerate decision-making in areas like sales research, customer support, and competitive analysis without compromising data security.", "body_md": "AI agents are a powerful tool for synthesizing data to accelerate research, summarize information, and help teams make decisions faster. But combining internal data with public sources poses security challenges.\n\nThis post shares [an open source example](https://github.com/NVIDIA/nemoclaw-community/tree/main/examples/personal-community-sentiment-triage) using [Hermes Agent](https://github.com/nousresearch/hermes-agent) with [NVIDIA NemoClaw](https://www.nvidia.com/en-us/ai/nemoclaw/) for product research across Outlook, Slack, and GitHub. [NVIDIA OpenShell](https://build.nvidia.com/openshell) enforces a security-approved runtime. The agent learns preferences and patterns, writing new memories and skills. The more users work with the agent, the better it gets.\n\nWhile the integration points are specific to this use case (Slack, Outlook, and GitHub), the pattern of safely mixing public and private data in a self-improving agent is important for many use cases, including sales research, customer support, engineering triage, competitive analysis, and internal knowledge discovery.\n\nYou will learn how to:\n\n- Bring up the open-source NemoClaw stack with one install command.\n- Wire the agent to two messaging channels (Slack and Outlook) and to community data (GitHub and the NVIDIA developer forums).\n- Teach the agent a recurring report format directly from a chat conversation—no code changes or gateway restarts required..\n- Save the agent’s learned state so it persists across deployments.\n\n**Prerequisites**\n\nTo follow along, you’ll need:\n\n- A host with a running Docker daemon. The example targets Ubuntu 24.04 but works on any distribution OpenShell supports.\n- A\n[build.nvidia.com](https://build.nvidia.com/)API key for inference. The default model is nvidia/nemotron-3-super-120b-a12b. Hermes Agent runs unchanged against a self-hosted NVIDIA Nemotron model on[NVIDIA NIM](https://developer.nvidia.com/nim), or vLLM when traffic must stay on-prem. - Credentials for at least one messaging integration:\n- An Outlook tenant plus a registered Azure app, or\n- A Slack workspace plus a Slack app.\n\nSetup instructions are available in:\n\n[docs/set-up-outlook-bridge.md](https://github.com/NVIDIA/nemoclaw-community/blob/main/examples/personal-community-sentiment-triage/docs/set-up-outlook-bridge.md)[docs/set-up-slack.md](https://github.com/NVIDIA/nemoclaw-community/blob/main/examples/personal-community-sentiment-triage/docs/set-up-slack.md)- A GitHub token for pulling data.\n\n## Install and bring up Hermes\n\n- Clone the repository and install OpenShell:\n\n```\ngit clone https://github.com/NVIDIA/nemoclaw-community.git\ncd nemoclaw-community/examples/personal-community-sentiment-triage\ncurl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.38 sh\n```\n\n- Copy the env template and fill in your inference key, plus at least one messaging channel.\n- Start the host-side services using the host-services shell script—then bring up the agent:\n\n```\nbash scripts/00-host-services.sh\nbash scripts/bring-up.sh\n```\n\nThe [bring-up.sh](http://bring-up.sh/) script starts Hermes inside the sandbox. The OpenShell sandbox does two critical things.\n\n- Manages the credentials, ensuring the Hermes agent never sees the Slack or Outlook tokens—authentication happens as requests exit the sandbox proxy.\n- Enforces network access policies. The agent has access to sensitive internal data from Outlook or Slack. To protect this data, the agent is prohibited from accessing the public internet.\n\nThe GitHub and NVIDIA forum data is available through a separate ETL process that retrieves the data and stores it, giving the agent read-only access. This setup ensures that even a compromised agent can not post data to external sites.\n\n- Once the script finishes, check that the sandbox is healthy:\n\n```\nopenshell sandbox list\n# hermes-direct should report Ready\nopenshell sandbox exec --name hermes-direct -- \\\n  curl -sf http://localhost:8642/health\n# {\"status\":\"ok\",\"platform\":\"hermes-agent\"}\n```\n\n- Send the agent a Slack DM or an email from the address you configured in\n`.env`\n\nto confirm it replies.\n\n## Teach once, recall anywhere\n\nWith the agent up and running, this section shows you how to teach it a new skill —and how that skill carries across conversations.\n\n1. Ask for a daily digest.\n\nTeach the agent to summarize GitHub issues each morning. Start by asking for the daily update:\n\n```\n> Give me a daily update on important issues for NemoClaw.\n```\n\nThe reply is helpful—some prose, some bullets—but it’s not in the correct format. Ask for a different format:\n\n```\n> That's too long. Give me exactly 5 top issues and 3 discussions, each with the number, title, state, URL, and a one-line \"why it matters\". Open with a bold header and close with **Bottom line:** in 2-3 sentences.\n```\n\nNow that the reply is a well-formatted digest, use positive reinforcement triggers and tell the agent to save this format for future use:\n\n```\n> Perfect, that's the format I want every day. Next time I ask for the daily NemoClaw issue digest, give me back exactly this shape—without me spelling it out again. And if a coworker emails the bot for the same thing, they should get the same shape, too.\n```\n\n2. Hermes writes a skill.\n\nWhen Hermes recognizes the pattern, it writes a [SKILL.md](http://skill.md/) to the filesystem. The file has a short YAML frontmatter (name and description) and the format scaffolding as the body.\n\n3. Snapshot, tear down, rebuild, restore.\n\nAgents in production are rebuilt when new code ships or configurations change. If learned skills do not survive, the agent must be retaught every time. To prevent this, take a snapshot, destroy the sandbox, rebuild from the image, and restore from the tarball to ensure the skill survives:\n\n```\nbash scripts/snapshot.sh\t      # writes.snapshots/<ISO-timestamp>.tar.gz\nbash scripts/tear-down.sh      # destroys the sandbox container\nbash scripts/bring-up.sh        # rebuilds the sandbox from the image\nbash scripts/restore.sh         # rehydrates /sandbox/.hermes-data/\n```\n\nThe snapshot captures the agent state, including skills, memories, sessions, and any scheduled jobs. A credential filter excludes files such as .env, *token*, and *secret* so the tarball is safe to share.\n\n4. Trigger the skill from a fresh conversation.\n\nFrom a new conversation, ask for the “daily NemoClaw issue digest over the last 3 days,” and the skill will return the same answer format. Only the numbers and titles change to match the underlying data. The format lives in the skill, not in conversational memory.\n\n## Why the architecture works: Model, harness, and runtime\n\nThe agent is deployed with [NVIDIA](https://github.com/NVIDIA/NemoClaw)[ ](https://github.com/NVIDIA/NemoClaw)[NemoClaw](https://github.com/NVIDIA/NemoClaw), a blueprint for open agents built with harnesses powered by open models in a secure runtime.\n\n| Component | What it does | Provided by |\n|---|---|---|\n| Model | Reasoning, tool selection, drafting |\n|\n\n[Hermes Agent](https://brev.nvidia.com/launchable/deploy?launchableID=env-3Azt0aYgVNFEuz7opyx3gscmowS)[NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell)*Table 1. The three components of the agent*\n\nFigure 1 shows how the layers fit together.\n\nThe network policy is code, not a prompt.\n\ndeclares every allowed destination, port, HTTP verb, and binary. This block authorizes inference:[policy.yaml](https://github.com/NVIDIA/nemoclaw-community/blob/main/examples/personal-community-sentiment-triage/policy.yaml)\n\n```\nnetwork_policies:\nnvidia:\n  endpoints:\n    - host: integrate.api.nvidia.com\n      port: 443\n      rules:\n      - allow: { method: POST, path: /v1/chat/completions }\n      - allow: { method: POST, path: /v1/embeddings }\n      - allow: { method: GET,  path: /v1/models }\n  binaries:\n    - path: /usr/local/bin/hermes\n    - path: /usr/bin/python3\n```\n\nIf the agent tries to reach a host not on the allowlist, the proxy returns a 403 (Forbidden) error, and Hermes Agent treats it as a tool error.\n\n### Observability with NeMo Relay and Arize Phoenix\n\nAgents make many decisions—which skill to call, which tool to invoke, what arguments to pass, what to send back to the user—per turn. When something goes wrong, a user can’t fix it without seeing what the agent actually did.\n\nThe deployed agent records traces in Agent Trajectory Format (ATIF). The sandbox image includes [NVIDIA NeMo Relay](https://github.com/NVIDIA/NeMo-Flow) by default, so these traces show up without additional setup. Before it’s torn down, [scripts/download-traces.sh](https://github.com/NVIDIA/nemoclaw-community/blob/main/examples/personal-community-sentiment-triage/scripts/download-traces.sh) pulls them off the sandbox. Setting `PHOENIX_COLLECTOR_ENDPOINT`\n\nin the `.env`\n\nfile enables live streaming of traces to a Phoenix collector for interactive debugging.\n\n## Adapt for different use cases\n\nWhile a main benefit of Hermes is self-improvement, the example can also be customized before deployment. Update the predefined skills and OpenShell policies to fit specific workflows and environments. The example ships with five skills, picked up automatically by the gateway from the [agents/hermes/skills/](https://github.com/NVIDIA/nemoclaw-community/tree/main/examples/personal-community-sentiment-triage/agents/hermes/skills) folder. Modify the OpenShell policies to give the agent access to data sources or tools.\n\nGet started quickly with NemoClaw: point your agent at NVIDIA-verified skills built into Claude Code, Codex, and Hermes Skills Hub with the full catalog published on [skills.sh](https://github.com/vercel-labs/skills) for use across Cursor, Gemini CLI, GitHub Copilot, Windsurf, and dozens more.\n\n### Learn more\n\nThe [NemoClaw Community repository](https://github.com/NVIDIA/nemoclaw-community) ships the full example used in this tutorial. To go deeper:\n\n- Read the\n[NemoClaw documentation](https://docs.nvidia.com/nemoclaw/latest/)for the blueprint reference and CLI. - Read the\n[NVIDIA OpenShell documentation](https://docs.nvidia.com/openshell/latest/home)for sandbox creation, policy syntax, and provider management. - Pick a Nemotron model from\n[build.nvidia.com](https://build.nvidia.com/), or self-host it with[NIM](https://developer.nvidia.com/nim).", "url": "https://wpnews.pro/news/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent", "canonical_source": "https://developer.nvidia.com/blog/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent-and-nvidia-nemoclaw/", "published_at": "2026-06-02 16:00:00+00:00", "updated_at": "2026-06-03 18:07:19.855922+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "generative-ai", "ai-research"], "entities": ["Hermes Agent", "NVIDIA NemoClaw", "NVIDIA OpenShell", "Slack", "Outlook", "GitHub", "NVIDIA", "Nous Research"], "alternates": {"html": "https://wpnews.pro/news/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent", "markdown": "https://wpnews.pro/news/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent.md", "text": "https://wpnews.pro/news/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent.txt", "jsonld": "https://wpnews.pro/news/deploy-self-evolving-agents-for-faster-more-secure-research-with-a-hermes-agent.jsonld"}}