OtherU separates local model inference from the software that can take actions. Ember generates responses; Hermes Agent connects those responses to tools, files, memory, and messaging accounts. The security of a deployment depends on the permissions and network access granted to each component.
Local inference and data flow
Ember runs the model on the operator's hardware. Its standard deployment listens on the loopback interface, so another machine cannot connect directly. Ember has no built-in API authentication. An API key entered in a client does not add authentication to the server. Remote access requires an authenticating gateway or a controlled private connection.
Local inference does not make the whole system offline. Messaging channels, web tools, model downloads, and any configured cloud providers communicate with external services. A self-hosted memory database can also use an external model for extraction or reflection. Those connections determine which data leaves the host. An air-gapped installation must exclude them and provision its dependencies separately.
Tool permissions and operator control
The model proposes actions; the agent and its tools execute them with the permissions of their service accounts. File access, shell access, messaging credentials, and desktop control therefore belong inside the deployment's trust boundary.
Approval rules and tool policies can limit execution, but they do not guarantee that a model will interpret a request correctly or resist every malicious instruction. Web pages, messages, retrieved memories, and files can contain instructions that conflict with the operator's intent. Operating-system permissions, restricted credentials, and independently enforced approval requirements provide boundaries outside the model's reasoning.
Computer-control tools have the authority of the connected desktop session. A KVM's keyboard and mouse interface does not make actions harmless: the agent can interact with whatever that session can access.
Credentials and stored context
Service credentials should be limited to the accounts and operations each integration needs. Keep them outside source control and restrict access to their files. A local environment file is configuration storage, not encryption or a secret-management service.
Conversation histories, screenshots, memory records, logs, and inference caches can contain sensitive information. Their access controls, retention, and backups need to match the data they hold. Shared channels and memory banks require explicit separation; a model instruction alone is not a privacy boundary.
Stopping and investigating activity
Stopping Ember prevents further inference on that instance. It does not cancel tools that have already started, stop scheduled agent work, or disable a configured fallback provider. To contain unwanted activity, stop the agent or affected integration and revoke its access where necessary.
Logs can help reconstruct events, but coverage depends on the component and configuration. Model-generated explanations and memory entries are not an independent audit record. Recovery procedures are described in Operations Runbook.
Reporting a security issue
Email security@otheru.ai with a description, the affected version or service, and steps to reproduce. Omit credentials and private customer data from the initial report. We can arrange a suitable way to exchange sensitive details.