Claude Code Not Enough? Hermes and OpenCloud Keep AI Agents Running in the Background

Coding assistants are crossing a watershed: from conversational tools that answer when you ask, to always-on background agents. According to analysis from a YouTube channel, tools like Claude Code and Codex can write code but don't run continuously in the background. Hermes and OpenCloud, two personal AI assistants, are built around round-the-clock availability, keeping an eye on email, calendars, and stock market data.

From Writing Code to Taking Over the Computer: The Agent's Form Has Changed

Over the past year, the AI coding tools developers are familiar with have essentially revolved around "sessions": open a terminal or editor, enter a request, get code back, close the window. Claude Code and Codex both fall into this category—capable, but their lifecycle follows the conversation.

Hermes and OpenCloud have a different positioning. They're described as personal AI assistants whose core selling point is "rund um die Uhr erreichbar"—reachable around the clock. They don't just respond to commands; they actively monitor information sources: whether there's new mail in the inbox, whether there are scheduling conflicts, whether watched stocks show unusual movement. This model pushes AI from "tool" toward "persistent agent," and the interaction shifts from pull to push.

The core difference between "conversational tools" and "persistent agents" lies in lifecycle and trigger mechanism. Conversational tools (like Claude Code and Codex) use a pull model: the user initiates a request, the model responds, and when the session ends, context and permissions are released—the risk window is brief and controllable. Persistent agents use a push model: the process stays resident long-term, holds credentials to poll or subscribe to external events (email, calendar, market data), and proactively pushes notifications to the user. This shift requires agents to have persistent state, background scheduling capability, and long-lived credential access—meaning it's no longer a stateless function you use and discard, but a software entity with memory, permissions, and continuous operation. Architecturally, persistent agents typically need a dedicated daemon, a credential vault, and an event bus, and these components themselves constitute a new attack surface.

What Hermes and OpenCloud Do

The functional overlap between the two products centers on three areas: email, calendar, and market data. This means they need continuous credential access and background processes, not one-off calls. For users, the benefit is that information no longer needs manual checking; the cost is that the permission boundary is stretched—the agent sees far more than a single conversation would.

From a product standpoint, this looks more like productizing the "personal assistant" role: you don't need to actively open it every day; it comes to you when something's up. The video doesn't go into technical differences or pricing details between the two, but it clearly lists "always online" as the dividing line from coding assistants.

The Attack Surface Behind the Convenience

The risk points of persistent agents are straightforward: being able to read email and touch files means one more potential entry point. An attacker doesn't need to break into your computer—simply inducing the agent to perform unauthorized operations, or using the credentials it holds for lateral movement, may be enough to obtain data that shouldn't be accessible.

This isn't a problem unique to Hermes or OpenCloud; it's the bill that all agents with "hands and feet" face. The risk window for conversational tools is one conversation; the risk window for persistent agents is 7×24. The more permissions granted and the longer the background runtime, the larger the exposure.

The Principle of Least Privilege is a foundational principle in information security: any subject should receive only the minimum access necessary to complete its task, and only for as long as necessary. For persistent agents, this principle faces challenges—the agent needs continuous access to email and calendar, the permission-holding period is stretched, and the traditional "temporary authorization" model no longer applies. In practice, it's often combined with credential isolation (separating the agent's credentials from the user's primary credentials, using revocable dedicated tokens) and sandboxed execution (limiting the filesystem and network scope the agent can reach) to contain risk. In addition, audit logs record every read and write operation by the agent and are a key means of tracing unauthorized behavior after the fact. Together, these mechanisms form the permission governance framework for persistent agents—none can be omitted.

Least Privilege Is Not a Slogan

The advice from the video is pragmatic: give it only the access it truly needs. At the operational level, this means authorizing on demand rather than opening everything at once—if it can read a specific folder, don't give it the entire disk; if it can check the calendar, don't attach write permissions; if it can view market data, don't bind a trading account.

Another implicit premise is isolation. Persistent agents are best run in a restricted environment, with credentials managed separately and the ability to revoke quickly if something goes wrong. For users who want to try it out, starting with a low-risk scenario (such as monitoring read-only information only) is far safer than handing over your primary email password outright.

What Persistent Agents Mean

From Claude Code to Hermes and OpenCloud, what's changing isn't just the feature list but the relationship between AI and users: from "I call it" to "it watches over me." This shift will drive up demand for infrastructure like permission models, audit logs, and credential management, and will turn "is the agent trustworthy" from an abstract discussion into an everyday decision.

For developers, what's worth watching is how these persistent agents extend—whether they open up plugins or tool integrations will determine whether they can grow from personal assistants into workflow hubs. For ordinary users, the more practical question right now is: are you willing to let a program watch your inbox around the clock? The answer depends on how much permission you give it.

Agent in the AI context usually refers to a system with autonomous decision-making and tool-calling capabilities: it can perceive its environment (read email, query calendars), plan actions (judge whether the user needs to be notified), and execute operations (call APIs or read/write files), rather than merely generating text passively. Compared with chatbots, the key characteristics of agents are autonomy and tool use. Persistent agents further add continuity—they don't wait for the user to wake them but run continuously according to preset policies. This form places higher demands on infrastructure: reliable process management, fine-grained permission control, observable runtime logs, and fast circuit-breaking mechanisms when things go wrong. The more autonomous and persistent the agent, the higher the requirements for the auditability and interruptibility of its behavior.

One-line Summary

AI coding assistants are shifting from conversational tools to round-the-clock persistent agents, and permissions and attack surface are expanding accordingly.

Paragraph Summary

The article compares conversational coding assistants like Claude Code and Codex with round-the-clock personal AI assistants like Hermes and OpenCloud, noting that the latter can continuously monitor email, calendars, and market data, with interaction shifting from pull to push. While this persistence brings convenience, it also expands the risk window from a single conversation to 7×24, and the email and file permissions held by the agent become a potential attack entry point. The article recommends on-demand authorization, isolated execution, and giving the agent only the permissions it truly needs, and notes that persistent agents will drive up demand for infrastructure such as permission models, audit logs, and credential management.