Hermes Agent in Practice: AI Vulnerability Discovery from Setup to Verification

AI Agents are evolving from chat tools into task-executing intelligent agents, and in the security field, they are beginning to be used for penetration testing and vulnerability discovery. A Bilibili creator shared an "AI bug-hunting pipeline" demonstrating how to build your own penetration testing agent with Hermes Agent—from environment configuration and model integration to arming it with a knowledge base and tool library, ultimately letting AI assist in completing vulnerability discovery. This article is based on that tutorial and outlines the technical path and practical key points.

Why Choose Hermes Agent for Penetration Testing

Traditional web-based AI can only offer suggestions or generate code, and users still need to copy it locally to compile and run. AI Agents, however, have the ability to send network requests—this is the fundamental reason they can automate penetration testing. After writing good prompts, the Agent can automatically execute steps such as information gathering and asset mapping.

The key reason for choosing Hermes lies in its memory accumulation mechanism. According to the creator, Hermes records the user's language style and forms "pitfall" records when tasks don't meet expectations; when executing similar tasks later, it references these lessons, thereby becoming more like the user the more it's used.

The core difference between an AI Agent and an ordinary chatbot lies in the ability of "tool calling." Chatbots can only generate text, whereas Agents, through mechanisms such as Function Calling or MCP (Model Context Protocol), can proactively initiate HTTP requests, execute system commands, and read/write files. In penetration testing scenarios, this means the Agent can independently complete port scanning, directory brute-forcing, fingerprinting, and other operations, rather than just giving commands for the user to execute manually. Frameworks like Hermes also typically have a built-in task planning loop: the model first breaks down the goal, selects tools, observes results, then decides the next step until the task is completed or fails.

Six-Step Workflow and Beginner Architecture

The creator breaks AI vulnerability discovery into six fixed steps: information gathering, asset mapping, AI-assisted analysis, manual verification, report writing, and platform submission. He emphasizes that "finding one bug is luck, finding ten is proficiency, and finding a hundred makes you a white-hat master"—the key is replicating a repeatable pipeline rather than reinventing the wheel.

For users with zero foundation, he recommends adopting an "agent-like architecture"—that is, borrowing from predecessors' experience. Beginners often cannot give AI clear goals, nor can they judge the severity of vulnerabilities, so they should first let AI stably output based on accumulated experience, then feed real cases back into their own capabilities. This architecture consists of three parts: the agent, the knowledge base, and the tool library.

Deploying Hermes: Environment Preparation and Model Configuration

Before installing Hermes, two environments are needed: Git and NodeJS. The creator reminds that NodeJS should use the LTS (Long-Term Support) version and avoid EOL versions that are no longer maintained. Windows users should choose the installer based on CPU architecture; if memory is insufficient, the portable version can be considered, but with limited functionality.

Hermes is installed via a PowerShell command, and the installation process takes about half an hour. After completion, enter Hermes Model in the terminal to access the model configuration page. The creator recommends DeepSeek^Ad for learning purposes; create a Key on the API open platform and configure the Base URL.

During configuration, you need to fill in the context length; the creator uses DeepSeek as an example and enters 1 million tokens. After saving, enter a test instruction to verify whether the model works properly.

For users not accustomed to the terminal, Hermes offers a Web UI version. After installation, start it with the Hermes-web-ui command, and you can complete model addition, memory viewing, and MCP plugin management in a visual interface; the configuration logic is the same as the terminal version.

Context Length refers to the maximum number of tokens a model can process in a single request, covering system prompts, historical conversations, tool return results, etc. Filling in too large a value during configuration may cause the request to be rejected by the model side or incur additional costs; filling in too small a value will cause frequent truncation of history during multi-turn tool calls. The creator filling in 1 million tokens for DeepSeek is a declaration of the upper limit; in actual use, Hermes will truncate according to the model's true supported capability. It is recommended to refer to the maximum context window specified in the model's official documentation when configuring for the first time, to avoid the Agent "losing memory" midway due to configuration mismatch.

Arming the Agent: Knowledge Base and Tool Library

Installing the agent is only the first step; it is not yet an expert. The creator emphasizes the need to connect a security knowledge base and tool library. The knowledge base can be connected with just one prompt, letting the Agent automatically call Git to pull skill resources prepared by predecessors to the local machine, with no manual import needed. These resources include fixed templates for information gathering (active and passive), command usage, interception syntax, etc.

For the tool library, connect remotely to a Kali virtual machine via SSH. The creator suggests installing Kali with VMware on a physical machine, obtaining the IP address of the eth0 network card, then giving the IP and the command to enable SSH to the Agent, which will automatically complete the connection and solidify it as a skill. This mechanism of "automatically generating skills after task completion" is exactly why Hermes is considered to become more human-like the more it's used.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic to standardize how AI models connect to external tools and data sources. In Hermes' Web UI, you can see the MCP plugin management entry; its role is to let the Agent call different tool servers (such as file systems, databases, security tool sets) through a unified interface, without writing separate adapter code for each tool. For penetration testing scenarios, MCP can encapsulate command-line tools like nmap and sqlmap as "skills" callable by the Agent, thereby extending its execution boundaries. Understanding MCP helps readers judge the ecosystem compatibility of different Agent frameworks.

Monetization Paths and a Rational Perspective

The creator mentions two main paths for monetizing vulnerability discovery: platform proof rewards and vendor point redemption, as well as exchanging for internal referrals and offers. However, it should be noted that the video content has obvious traffic-attraction characteristics, including guiding fans to send specified passwords to obtain toolkits, and using exaggerated expressions like "a thousand a night" and "money-printing pipeline." Readers should rationally view the actual threshold of AI bug hunting—AI can reduce the burden of repetitive labor, but vulnerability verification and severity assessment still require manual completion, and compliant testing must be conducted within an authorized scope.

Overall, the value of this pipeline lies in demonstrating the engineering approach of Agent-type tools in security scenarios: using memory accumulation to build experience, injecting domain knowledge through a knowledge base, and extending execution boundaries with SSH. For technical personnel who want to understand how AI Agents are actually implemented, it has certain reference value.

One-line Summary

A Bilibili creator shares the six-step workflow and practical key points for building an AI penetration testing pipeline with Hermes Agent.

Paragraph Summary

Based on a Bilibili creator's tutorial, this article outlines how to build a penetration testing agent with Hermes Agent. The core argument is that AI Agents can send network requests, which is the fundamental reason they can automate penetration testing; Hermes' memory accumulation mechanism makes it increasingly align with user habits over time. The article breaks down the six-step workflow (information gathering, asset mapping, AI-assisted analysis, manual verification, report writing, platform submission) and details practical steps such as environment preparation (Git, NodeJS LTS), model configuration (DeepSeek, context length), automatic knowledge base pulling, and SSH connection to a Kali virtual machine solidified as a skill. It also reminds readers to rationally view the traffic-attraction and exaggerated expressions in the video, as AI bug hunting still requires manual verification and authorized compliance.