The 5 Questions an AI Agent Install Wizard Asks — How I Answered Them on a Work Mac

Introduction

I installed an open-source AI agent (Hermes Agent) on my work Mac. The installation itself took five minutes — but during those five minutes, the setup wizard asked me five questions. And while answering them, I realized that these five answers determine not how smart the agent is, but how safe it is.

The wizard asks:

1. Which model to use (choose from 5 free options)
2. Where to execute commands (Local / Docker / SSH / cloud sandbox)
3. Whether to enable an egress firewall on the Docker sandbox
4. Whether to connect a messenger (Telegram, etc.)
5. Whether to share usage statistics

This post walks through how I actually answered, what tripped me up, and the reasoning behind each choice.

Gotcha 1: Decide the execution environment before the model

The wizard asks about the model first, but the priority is the other way around.

This Mac holds SSH keys that reach production servers, and repositories containing DB credentials. If you pick Local as the execution environment, the agent reads files and runs commands with your user privileges — which means everything the agent reads, and every command output, gets sent to the model provider. If you're on a free model, that's a configuration you want to avoid even more.

So I chose the Docker sandbox. The first run promptly failed:

Error: Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
Is the docker daemon running?

The cause was trivial — Docker Desktop simply wasn't running.

open -a Docker   # wait a few dozen seconds for the daemon
docker info      # you're good once the Server section appears

Re-ran the wizard and it went through. If you're a Mac user who "has Docker installed but rarely uses it," start by launching the daemon.

Gotcha 2: Assume free models log your input — and may disappear

Free models often record your input and use it for training. This is especially true for models like stealth/... where the provider is anonymous — there's no way to verify where your data ends up. Free tiers also have tight rate limits and can be discontinued without notice, so they're a poor foundation for automation that runs daily.

I picked a free large model from a clearly identified provider, on the premise that work files never leave the Docker sandbox anyway.

Gotcha 3: Don't answer an unfamiliar 5-way model choice with "I don't know"

That said, out of the five model names listed, I had used exactly zero. If you settle this with "no idea, whatever," you won't be able to help the next person who faces the same screen.

I did three things: state the limits of my evidence (all you can read from a model name is its approximate parameter scale), commit to one anyway, and — most importantly — confirm how to change it later.

hermes model        # switch models interactively

Once you know the change command exists, the initial choice becomes a provisional one. Don't let the model picker become a blocker.

The remaining two: egress firewall and messenger integration

Egress firewall: Yes. This puts outbound traffic from the container on an allowlist, closing off routes for the agent to send data somewhere unexpected. There is a side effect: package installation inside the container may get blocked. If pip install or npm install fails later, suspect this setting first.

Messenger integration: Skip. It lets you command the agent via DM from Telegram and the like — but the moment you connect it, that messenger account becomes a remote shell into your Mac. If the account gets compromised, the attacker can effectively run commands on your machine. Not on a work machine.

I also turned off usage statistics sharing.

Verification: the final configuration

The install took five minutes. Thinking took longer than typing.

Summary

The security of an agent installation is decided not by "which model is smartest" but by what this process can read, and where what it reads goes.

One more thing: the wizard's defaults are "the settings that let you try it fastest," not "the safest settings." Local execution, messenger integration recommended, firewall off — those were all the defaults. On a work machine, it's worth pausing to ask what an Enter-mashing install has just granted.