Hermes Agent Bubblewrap + Which AI Models To Run Behind The Sandbox, With Real GoldieBench Scores For Opus 5, GPT-5.6 Sol, Hermes MoA, Kimi K3 And GLM-5.2

Hermes Agent bubblewrap decides where your agent's commands run, not which model writes them, so the model choice is still yours and GoldieBench is a decent place to start it.

The plugin is the official Linux sandbox for Hermes, built and supported by Nous Research per its README, and the v0.23.0 catalog pins version 1.3.0.

Every score on this page is one I read on the live GoldieBench models page on 8 November 2026.

If you would rather plan your model stack with my team, book a free SEO strategy session.

The Sandbox Wraps Commands, Not The Model

Hermes talks to your model provider the same way it always does.

What changes is the next step: every terminal and execute_code call the model asks for runs inside its own bwrap sandbox on your Linux machine.

The README notes that provider API keys stay out of that command environment.

So any model Hermes supports keeps working, and the sandbox simply limits what its commands can touch: a read-only host, one writable folder, hidden credential stores, and caps on memory, CPU time and processes.

What GoldieBench Measures, And What It Does Not

The methodology page lays out the rules: each model gets the same fixed prompt, one shot, and must return a single self-contained HTML file.

Julian scores each result from 0 to 10, and a model's rank is its average across the tasks it was scored on.

That maps neatly to one sandbox job: the agent writing a file into the working folder in one go.

It does not measure how a model handles shell errors, read-only paths or a killed process.

Treat the scores as a guide to first-shot build quality, not to sandbox behaviour.

Every demo on the bench was built inside the Agent Operating System, the methodology page adds, so the scores come from an agent setup rather than a bare chat window.

The Shortlist, Read On 8 November 2026

LongCat-2.0 also shows 8.12, but on only 4 tasks, so I leave it off a shortlist built on averages.

Pair By Profile: Restricted Review Jobs

Under the restricted profile the working folder is read-only and only loopback networking works.

The job is reading and explaining, such as checking a script a bookkeeper downloaded before anyone runs it.

Nothing gets built, so build scores matter less here.

Pick a model you already trust for careful reading, and use the bench mainly to rule out the bottom of the table.

Pair By Profile: Workspace Build Jobs

workspace makes the folder writable with no internet, which suits an agency building a landing page or a report generator from files already on disk.

This is where GoldieBench's one-shot builds line up best with the work.

Claude Opus 5 at 8.27 and GPT-5.6 Sol at 8.16 lead the single models, each across 50 scored tasks.

If a build needs the whole project in view, Kimi K3 at 7.89 and GLM-5.2 at 7.77 both list 1M-token context on the models page.

Pair By Profile: Network Install Jobs

The default network profile shares the host network, which package installs need.

The bench does not test installs, so the score gap matters less than the limits.

Whichever model you use, raise memory_mb to 1024 or 2048 first, because the README warns pip, node, cargo and most compilers need more than the default 256 MB.

A model that writes a sensible build will still fail with MemoryError or exit 137 if the limits stay at their defaults.

Where Hermes MoA Fits

Hermes MoA sits third on the board at 8.17 across 47 tasks.

Its page describes a panel of models whose drafts a chair merges, and lists a latency of roughly 110 to 140 seconds per single-file build against one call for a solo model.

The sandbox does not care: it only sees the commands that come out the other end.

Use MoA when a one-shot build matters more than speed, and a solo model for quick file chores.

Open-Weights And Local Options

GLM-5.2's page lists open weights and says it runs locally, which fits a small business that wants the model on its own hardware next to the sandbox.

For strictly on-device models, the local models page lists Qwable 5 27B Coder at 7.14 across 41 tasks, the top local score there.

Those local results were run with Ollama on macOS, and bubblewrap is Linux only, so treat them as a guide to the model, not to this setup.

A Worked Example: An Agency With Two Models

Here is how a three-person web agency could split the work on one Linux build server.

1. Install the plugin and set memory to 2048 MB so builds have room.
2. Use a top single model from the table, such as Claude Opus 5 or GPT-5.6 Sol, for workspace jobs that write landing pages into the client folder in one go.
3. Use a lighter or local model the team already trusts for restricted jobs: reading a new script, summarising a log, checking a file.
4. Switch to network only for dependency installs, then back.
5. A person reviews every changed file before anything ships.

The sandbox settings stay the same whichever model is on duty; only the profile and working folder move per job.

Inside the AI Profit Boardroom, members compare which models they give each kind of job in their own Agent OS.

Reading The Scores Without Fooling Yourself

• A higher average is a better first shot on Julian's tasks, not a promise for your files.
• Check the task count: a model scored on 4 tasks is not comparable with one scored on 50.
• The bench never runs inside a sandbox, so it says nothing about how a model reacts to a read-only error.
• Under bubblewrap, failed attempts still cost a fresh sandbox per command, so first-shot quality is worth something.

Set It Up Before You Pick

sudo apt install bubblewrap
hermes plugins install bubblewrap
hermes config set terminal.backend bubblewrap
hermes doctor

The plugin needs Hermes 0.22.6 or later, bubblewrap 0.9.0 or later, prlimit and unprivileged user namespaces.

On Ubuntu 24.04 and later, the AppArmor user-namespace restriction can make the doctor probe fail until you relax it for bubblewrap.

Approvals keep working as on the local backend, unlike the container backends that the security guide says skip the check.

The plugin shipped as a new official plugin in the v0.23.0 release, and our list of the best Hermes Agent plugins covers what else to install.

Also On Our Network

• Agent Operatorsthe six-step setup for running every Hermes command inside bwrap
• AI Income Deskwhether the bwrap sandbox is worth it for a small business server
• AI Tool Verdicta scored verdict on the bwrap sandbox, with its gaps called out
• agentos.guidea quick start plus four prompts to test the bwrap sandbox
• aiprofitboardroom.comthe complete Hermes Agent Bubblewrap guide on the AI Profit Boardroom blog

Pick one model from the shortlist for builds, one for review jobs, and book a free SEO strategy session or join the AI Profit Boardroom if you want help choosing models to run behind Hermes Agent bubblewrap.