Hermes Goes Enterprise: What Nous Research's $90M Raise Means for Open-Source AI Agents at Work

Open-source AI agents have spent the past year growing up in public: cloned millions of times, run on laptops and $5 servers, and quietly adopted by teams long before any procurement process noticed. This week, one of the most popular of them crossed into the enterprise market. On October 7, Nous Research announced a $90 million Series B to take its open-source Hermes Agent into business use, at a reported valuation of $1.5 billion.

For technology leaders, the funding number is the least interesting part. The real story is what it signals: an agent that your developers may already be running for free is about to be sold to your company as a managed product. This post covers what Nous announced, why Hermes is different from a typical chatbot, what the security record looks like so far, and a practical checklist for deciding whether an open-source agent belongs inside your organization.

What Nous Research Actually Announced

Nous Research raised $90 million to build Hermes for Businesses, a commercial version of Hermes Agent. According to The Next Web’s coverage of the Wall Street Journal report, the product lets companies choose models based on price and goal, keep their AI use private, and own their internal knowledge. Investors named in coverage include Nvidia, Microsoft’s M12, Samsung, Robot Ventures, Union Square Ventures, Y Combinator and Menlo Ventures.

The traction claims

Nous says Hermes has been cloned more than 24 million times since its February release and, by its own internal estimate, accounts for about 2.5% of global AI token usage. The Wall Street Journal reportedly put annualized revenue at about $36 million by mid-September, with the company expecting to pass $100 million by year-end.

Treat these numbers with care. The valuation comes from the WSJ rather than from Nous, the token-share figure is an internal estimate, and a “clone” is not a paying customer. As one analysis noted, GitHub interest alone does not show customer demand. The round is a test of whether an open-source agent can support a paid enterprise business.

Why Hermes Is Not “Just Another Chatbot”

Hermes Agent was released under the MIT license and is designed as a long-lived process rather than a single chat session. Based on TrueFoundry’s technical overview (a vendor that sells competing governance products, so read its framing accordingly), three traits matter for enterprise buyers.

It remembers

Hermes keeps persistent memory files for environment facts and user preferences, and can search past sessions. Context that used to vanish at the end of a chat now accumulates on disk.

It writes its own skills

After working something out, the agent can write a reusable skill file describing when to use a procedure, the steps, the pitfalls and how to verify the result, and then refine it with use. That is a genuine productivity gain, and also a new kind of artifact your organization now has to review.

It is always on and has real access

It can run on a laptop, a cheap VPS or serverless infrastructure, reach users through chat tools such as Slack and Telegram, and execute shell commands. Each instance holds its own credentials, model keys and memory, with no shared identity model or central audit in the open-source version. Approval settings live in a per-host configuration file, and a “YOLO” mode can bypass approval prompts.

If that sounds familiar, it should. It is the same pattern behind the persistent execution environments that enterprise IT is now being asked to host, and the same pattern that makes always-on AI agents a governance challenge as much as a productivity tool.

The Security Record So Far

Popularity attracts scrutiny, and Hermes is no exception. Vulnerability databases list CVE-2026-9353, an injection flaw in the agent’s Skills Guard component, rated CVSS 7.3 by one tracker, with the recommended fix being an upgrade to version 0.15.0 or later. Scores and affected-version details differ between aggregators, so verify against the project’s own advisories before acting on any single number.

The wider lesson is not that Hermes is uniquely risky. Any agent that installs skills from public repositories and acts on web content inherits the supply-chain exposure we described in the skill marketplace blind spot. The difference now is that these tools are moving from hobbyist machines to systems holding production credentials.

What “Open Source, Now Enterprise” Changes for Buyers

Nous is not alone. The Next Web notes that Nvidia has built an enterprise platform on the open-source OpenClaw agent, and large vendors are racing to put identity, monitoring and ownership controls around agents. The pattern is consistent: free, popular agents spread bottom-up, then a commercial layer arrives to add the controls that regulated companies require.

The upside

Open-source agents give you model choice, no single-vendor lock-in and the ability to inspect what runs in your environment. For teams worried about dependence on one frontier lab, that flexibility is real.

The trade-offs

You also take on responsibility that a closed vendor would otherwise carry: patching, skill vetting, credential hygiene and audit trails. A managed enterprise tier promises to absorb some of that burden, but a product announced this week has no long record to judge. This is exactly the situation that WSO2’s open-source control plane bet tried to address from the governance side.

A Practical Checklist Before You Adopt

Find the shadow instances. Developers may already run Hermes or similar agents on personal machines or small cloud servers. Inventory first; every one is a non-human identity nobody provisioned.
Give every agent its own scoped identity. No shared tokens, no personal credentials, least-privilege access to each system.
Disable approval bypasses in production. Settings like YOLO modes belong on a developer laptop, never on a host with real data.
Treat skills as code. Review, version and sign off on agent-written and third-party skills the way you would a pull request.
Pin and patch versions. Track the project’s security advisories and upgrade deliberately.
Demand audit evidence from any enterprise tier. Ask for single sign-on, permission controls, logging and data-residency details in writing, not in a slide.
Run a bounded pilot. Choose one workflow with low-risk data, define success metrics, and compare total cost against a closed vendor.

Conclusion

Nous Research’s raise is a marker of where agentic AI is heading: the most capable agents are no longer confined to the big labs’ products, and open-source projects are racing to become enterprise platforms. That is good for competition and model choice, but it moves the burden of governance onto buyers who may not realize the agent is already running inside their walls.

The actionable takeaways are simple. Discover what is already deployed, give agents their own identities and least-privilege access, treat agent-written skills as code, and make any enterprise tier prove its audit and permission controls before it touches production data. If you are mapping how to do that for your own stack, our guide on what agentic AI means for business leaders is a good starting point.

Frequently Asked Questions

What is Hermes Agent?

Hermes Agent is an open-source AI agent from Nous Research, released under the MIT license in February. It keeps persistent memory, writes reusable skills, lets users choose their model, and can run on a laptop, a server or serverless infrastructure.

How much did Nous Research raise, and at what valuation?

Nous announced a $90 million Series B on October 7, 2026. The $1.5 billion valuation was reported by the Wall Street Journal; Nous itself did not disclose a valuation.

What is Hermes for Businesses?

It is the commercial version of Hermes, aimed at companies that want to choose models by price and goal, keep AI use private and own their institutional knowledge. Detailed feature and pricing information has not been widely published yet, so ask the vendor directly.

Is Hermes Agent safe to use at work?

It can be, with controls. A vulnerability (CVE-2026-9353) has been reported in its Skills Guard component, and the open-source version has no central identity or audit layer. Pin patched versions, scope credentials tightly and review skills before enabling them.

Are the “24 million clones” a measure of customers?

No. Clones are repository copies counted by Nous, not paying users, and the 2.5% share of global token usage is the company’s own internal estimate.

Should we choose open-source agents over closed vendors?

Neither is automatically better. Open source offers flexibility and inspectability, while closed vendors absorb more operational and security work. A bounded pilot with clear success criteria is the safest way to compare them.