Building Your Own Hermes AI Hacking Agent: A Complete Setup Guide

Why Most Guides Get This Wrong

Most "AI hacking agent" tutorials throw you into a wall of commands. You copy-paste half of it, miss a critical step, and end up with a very expensive chatbot that occasionally runs curl. The problem isn't the tools it's the sequence. This guide follows the actual order things need to happen, from infrastructure to automation.

The goal here is to build a Hermes AI Agent for ethical hacking, reconnaissance, and bug bounty automation, then give it specialized security skills one milestone at a time.

A quick note before we start: this guide follows a widely shared architecture and workflow, but it doesn't independently verify every installation command, provider, or feature. Always check the current official documentation before executing anything.

Phase 1: Infrastructure

Choosing a VPS

You need a Linux VPS that can run Hermes and your security tools. A solid starting configuration:

Any compatible provider works. The important part is having a real Linux box with enough resources not which company's logo is on the invoice.

Purchasing and Configuring the Server

1. Open your VPS provider
2. Select a plan
3. Choose Ubuntu 24.04
4. Select your server region
5. Set a strong root password
6. Complete deployment
7. Copy your VPS public IP address

Connecting via SSH

Open PowerShell, Windows Terminal, or a Linux terminal:

ssh root@YOUR_VPS_IP

Enter your password, then update the system and install the basics:

apt update && apt upgrade -y
apt install -y curl wget git unzip nano tmux

Checkpoint: You should now have access to your Ubuntu VPS.

Phase 2: Installing Hermes Agent

Installation

Visit the official Hermes Agent documentation and follow its current Ubuntu installation instructions. Once installed, launch it:

hermes

Complete the initial setup wizard.

Configuring Your AI Model

You'll need an API provider account, an API key, a model identifier, and provider configuration. Model choices typically fall into these categories:

Two things worth emphasizing. First, keep API keys in environment variables or the agent's secure credential configuration — never paste them into public skills or GitHub repositories. Second, don't assume free models are suitable for security testing. Evaluate reliability first.

Phase 3: Connecting Telegram

Creating the Bot

1. Open Telegram and search for @BotFather
2. Send /newbot
3. Enter your bot's display name
4. Enter a unique username ending in bot
5. Copy the generated Telegram Bot Token

Never share this token. Anyone who gets it can control your bot.

Getting Your Telegram User ID

1. Search for @userinfobot on Telegram
2. Start the bot
3. Copy your numerical Telegram user ID

Wiring It All Together

Return to your VPS and run:

hermes

Open the gateway/channel configuration through the setup wizard:

1. Select Telegram
2. Choose manual configuration
3. Enter your Telegram Bot Token
4. Enter your Telegram user ID as the authorized user
5. Save the configuration
6. Restart the gateway using the documented service instructions

Test by sending: "Hello, who are you?"

Checkpoint: Your Hermes agent should now respond through Telegram.

Phase 4: Accessing the Hermes Dashboard

On your local computer, set up an SSH tunnel using the general format:

ssh -L LOCAL_PORT:127.0.0.1:REMOTE_PORT root@YOUR_VPS_IP

Use the actual dashboard port configured by Hermes. Keep this terminal open, then visit the corresponding localhost address in your browser — for example:

http://localhost:1920

Never expose the dashboard directly to the public internet without proper authentication and network restrictions.

Phase 5: Building Cybersecurity Skills

This is the phase that matters most. A skill is a collection of instructions and procedures that tells Hermes how to perform a particular task. Without skills, you have a general-purpose chatbot. With them, you have a security tool.

The Starting Skill Set

Each skill should have its own instructions, workflow, constraints, and output format.

Building the Recon Skill

In Hermes, open the Skills section, create a new skill named recon, and build its instructions around:

1. Accept an authorized target
2. Verify the target is in scope
3. Discover subdomains using permitted sources
4. Identify live hosts
5. Collect HTTP metadata
6. Identify technologies and services
7. Compare results with previous reconnaissance data
8. Produce a structured report

Example output format:

{
  "target": "example.com",
  "scope_verified": true,
  "subdomains": [],
  "live_hosts": [],
  "technologies": [],
  "new_assets": [],
  "timestamp": ""
}

Only operate on assets explicitly authorized by the program or client.

Building the XSS Skill

Create a skill named xss-hunter with this workflow:

Input URL / Authorized Target
  → Inspect HTTP Response and Content Type
  → Identify Parameters and Inputs
  → Test Reflection in Authorized Environment
  → Analyze Context and Encoding
  → Validate Potential XSS
  → Generate Evidence and Report

Key instructions to include:

• Check response content type
• Identify GET and POST parameters
• Distinguish reflected input from executable HTML
• Analyze HTML, attribute, and JavaScript contexts
• Avoid aggressive payload spraying
• Use harmless proof-of-concept tests
• Never claim a vulnerability without evidence

Building the IDOR Skill

Create idor-hunter with this workflow:

1. Identify object references
2. Understand the application's authorization model
3. Use test accounts you control
4. Compare access between authorized test identities
5. Check whether server-side authorization is enforced
6. Record evidence without accessing other people's private data
7. Generate a report

Building the Master Web Scan Skill

Create web-scan — the orchestrator skill. Its job is to decide which specialized skill should run:

The master skill should never automatically run every test against every target. It should first verify scope, inspect the application, and select relevant tests.

Phase 6: Teaching Hermes Through Research

Instead of asking an AI to invent an entire methodology, feed it quality technical resources. Sources worth studying:

• HackerOne — public vulnerability reports
• PortSwigger Web Security Academy — free labs and research
• OWASP — security documentation
• HackTricks — technical security knowledge base

In Hermes:

1. Open Chat
2. Provide relevant research URLs
3. Ask Hermes to extract the methodology
4. Ask it to distinguish verified techniques from assumptions
5. Ask it to identify prerequisites and limitations
6. Use Learn Skill to generate the skill
7. Review the generated instructions
8. Test it against intentionally vulnerable labs

Example prompt:

Study the provided security research resources.

Extract:
- Vulnerability identification methodology
- Testing prerequisites
- Technical conditions
- Detection techniques
- Validation methodology
- False-positive scenarios
- Reporting requirements

Do not blindly trust the sources.

Identify conflicting claims and unsupported techniques.
Create a structured skill based on verified findings.

The skill must operate only on authorized targets
and must include safe testing constraints.

Phase 7: Independent Validation

Create a validator skill ideally backed by a different, stronger AI model. The validation process:

1. Receive a potential finding
2. Inspect the original request and response
3. Check whether the evidence supports the claim
4. Reproduce it in an authorized environment
5. Check alternative explanations
6. Identify false positives
7. Assign a confidence level
8. Require human approval before reporting

Using a second AI model does not guarantee correctness. Independent evidence and manual verification matter far more than model agreement.

For every validated finding, generate:

• Vulnerability description
• Affected endpoint
• Reproduction steps
• Request and response evidence
• Impact
• Safe proof of concept
• Remediation recommendations

Use JSON and Markdown as primary report formats. Avoid generating exploit files that automatically attack real users or external systems.

Phase 8: Automating Reconnaissance

Open Hermes Cron Jobs and create a new scheduled job:

The conceptual workflow:

Daily scheduled trigger
  → Load authorized scope
  → Discover new assets
  → Compare with historical asset list
  → New asset detected?
      → Yes: Notify through Telegram
      → No: Update monitoring log

Example automation instruction:

Every day, execute the recon skill for my
authorized bug bounty targets.

Compare discovered assets with the previous
reconnaissance database.

If new assets are discovered:
1. Verify they are within scope.
2. Record their discovery time.
3. Identify basic HTTP metadata.
4. Notify me through Telegram.
5. Do not automatically perform intrusive tests.

Generate a daily summary.

Ensure Hermes has permission to send messages to your Telegram account. Test the notification manually before enabling the scheduled job.

The Final Architecture

Here's how all the components fit together:

                  YOU
                   |
             TELEGRAM BOT
                   |
              HERMES AGENT
                   |
          MAIN ORCHESTRATOR
                   |
        +----------+----------+
        |          |          |
      RECON      WEB SCAN   VALIDATOR
                   |
          +--------+--------+
          |        |        |
         XSS     IDOR     SSRF
          |        |        |
          +--------+--------+
                   |
             EVIDENCE
                   |
             HUMAN REVIEW
                   |
             REPORT ENGINE
                   |
           JSON / MD / POC
                   |
                YOU

Implementation Checklist

• [ ] Provision Ubuntu VPS
• [ ] Connect through SSH
• [ ] Install Hermes Agent
• [ ] Configure AI model and API
• [ ] Create Telegram bot
• [ ] Connect Telegram to Hermes
• [ ] Verify Telegram communication
• [ ] Access Hermes dashboard securely
• [ ] Create Recon skill
• [ ] Create XSS skill
• [ ] Create IDOR skill
• [ ] Create Web Scan orchestrator
• [ ] Collect quality security research
• [ ] Generate skills using Learn Skill
• [ ] Create independent Validator skill
• [ ] Implement evidence-based reporting
• [ ] Configure daily reconnaissance cron job
• [ ] Test notifications
• [ ] Test everything on authorized labs

Don't Build Everything at Once

Split your first implementation into four milestones:

The sensible approach is to get a reliable agent working first, then gradually give it specialized cybersecurity capabilities. Otherwise, you'll end up with a very expensive chatbot that occasionally runs curl.

Final Thoughts

The real power of an AI hacking agent isn't raw automation it's the structure you give it. Skills encode methodology. The validator enforces skepticism. The orchestrator prevents blind spraying. And human review keeps you legally and ethically grounded.

Build slowly. Test on labs. Verify everything. And always only operate on targets you're explicitly authorized to test.