For most of the last few years, the practical limit on AI agents has been less about reasoning and more about access.
Since OpenAI released ChatGPT, helping ignite the current large language model (LLM) race, public pages have been relatively easy for automated systems to navigate. Anything behind a login, a cookie, a two-factor prompt, or a session that already exists in a person's everyday browser has been harder. That is where many agents still stop.
Labs and startups have spent the past few years building around that boundary rather than through it. The approaches have included hosted Chromium sandboxes, separate AI browsers, browser extensions, and cloud profiles that retain credentials after a user has authenticated.
Nous Research, the New York lab known for its open-weight Hermes language models and the self-hosted agent built around them, introduced another approach this week.
Hermes Agent v0.20.6 added a consent-gated option called real-profile browsing.
When enabled, the agent does not attach itself to the user's live Chrome window. Instead, it copies the active Chromium-family browser profile, including its cookies, saved logins, and preferences, into a managed snapshot under the user's Hermes directory. Hermes then drives that copy using a packaged Chromium instance.
The result is a browser environment that resembles the user's normal browsing environment more closely than a clean, isolated session, while leaving the original profile untouched.
In other words, the agent becomes the user.
Not literally, of course. What changes is the identity available to the browser. The agent inherits the authenticated state that the user has already established in the copied profile.
Real-profile browsing is off by default. When it is turned on, Hermes does not attach to the live Chrome window.
It copies the active Chromium-family profile (cookies, saved logins, preferences) into a managed snapshot under the user's Hermes directory, then drives that copy with a packaged Chromium instance.
Auth files are re-synced when a new session starts, so a login completed in the ordinary browser can appear in the agent's next run.
The original profile is left alone.
Recent Chrome releases block remote debugging of the default profile directory, and two processes sharing one profile can lock or crash it. On Windows the source browser has to be fully quit, including tray processes, before the copy can be made. macOS and Linux can copy while the browser is running. Chrome, Edge, Brave, and Chromium are supported. Firefox is not.
Turning the option off deletes the snapshot the next time the browser is used.
The browser itself was already there.
Hermes shipped in February 2026 with local control through the Chrome DevTools Protocol, a headed window, and cloud sessions.
The default local session was a clean profile with no logins. That made the agent safer and less useful for anything that assumes the user is already signed in.The more recent building block was Browser Use mode, posted on 10 August.
Hermes had twelve separate browser tools.
That release collapsed them into one, driven by Browser Use’s CLI 3.0, so the agent writes a script instead of issuing a tool call per click. Nous said tests cut token use by 48 to 66% with no drop in accuracy.
Cloud Browser Use sessions could already keep cookies and saved passwords in a vendor profile. Local browsing still started empty.
Version 0.20.6 does not add a browser so much as change which identity the local browser carries.
The clean profile remains the default. Real-profile browsing is the exception: a local snapshot of the active profile, stored under ~/.hermes, removed when consent is withdrawn.
That sits between two common designs.
OpenAI’s Operator, later folded into ChatGPT Agent and Atlas, runs tasks in a remote browser. Anthropic’s computer-use models can drive a desktop from screenshots and clicks, usually in a sandbox. Claude in Chrome works inside the window the user already has open. Google’s Project Mariner took a similar Chrome-native path before that work moved into Gemini Agent and Chrome Auto Browse.
Browser Use and other cloud tools keep a persistent remote profile that the user sets up separately.
A public page does not care which of those you pick.
A mail account, an internal dashboard, or an airline booking does. Hosted agents often ask for a fresh login inside someone else’s Chromium. Extensions use the live session and share the same profile lock as ordinary browsing. Hermes copies the session onto the same machine and runs it in a second directory.
The copy is not a security boundary. It avoids fighting the live browser for a profile lock. It does not make the inherited cookies less valid.
Hermes snapshots only the active profile, does not merge other Chrome profiles, and does not claim to solve CAPTCHAs or bot checks. Enable it only for work that should run as the user. The rest of the stack, including the August Browser Use mode, still works with an empty profile.
