Sign in Subscribe

Hermes Agent Memory With Uteke: Local Recall That Never Phones Home

A September privacy study found trackers on all nine consumer chatbots it tested. Uteke's committed Hermes plugin keeps agent memory on your disk, with recall on every turn.

Hermes Agent Memory With Uteke: Local Recall That Never Phones Home

A September study from researchers at IMDEA Networks found that every consumer chatbot they tested ships at least one third-party tracking service, and that six of nine web clients pass conversation titles, prompts, and screenshots to those services. On October 1, Uteke committed a Hermes plugin package to its public repo: automatic memory recall for local agents, with no third-party endpoint in the loop. One finding describes the risk. The other is a structural answer to it. This post connects the two.

What the study found

Researchers at IMDEA Networks and UC3M analyzed nine conversational AI services in May 2026: ChatGPT, Claude, Gemini, Grok, DeepSeek, Perplexity, Microsoft Copilot, Mistral's Le Chat, and Meta AI. Their paper, "Prompt like a Butterfly, Sting like a Tracker", went up in September 2026 and combines static and dynamic analysis of web and Android clients across guest, free, and premium tiers. The team also ran a responsible disclosure process with the affected providers and European data protection authorities.

The headline numbers:

  • 44 third-party organizations across the nine services, and every service integrated at least one advertising or tracking service.
  • 6 of 9 web clients and 3 of 8 Android clients disclosed conversation URLs, titles, prompts, or screenshots to third parties, often alongside persistent user identifiers.
  • Several providers expose conversation permalinks without access controls, which lets a tracker read the entire conversation.
  • Consent changes the picture: some third-party services activate only after a user accepts non-essential cookies.

The paper cites a Reuters report that OpenAI ran an advertising pilot with Criteo for ChatGPT's free tier in the US in early 2026. Advertising infrastructure moving into chat is not hypothetical anymore. The Hacker News thread on the paper reached 425 points within four days of posting, so the finding has reach beyond the privacy research crowd.

One scoping note: the study tested consumer chatbots, not coding agents. Nothing in it says your IDE assistant leaks prompts the way the tested web clients do. The structural argument still transfers, and the rest of this post goes there.

Why memory raises the stakes

People type their most sensitive material into agents: private code, business plans, health questions, legal drafts. The study shows that on some platforms, the artifacts around those prompts (titles, previews, screenshots) reach third parties, sometimes with identifiers attached.

Memory makes this worse in an interesting way. A chat transcript is a pile of artifacts. A memory store is the distilled version: what you work on, what you decided, what you care about. The more useful your agent's memory gets, the more valuable a copy of it becomes. Handing that index to a service that also runs ad-tech is a choice, and most people never got to make it.

The local alternative, concretely

Uteke is a local-first memory engine: one Rust binary, SQLite with an HNSW vector index and ONNX embeddings, CPU only, fully offline, Apache-2.0. The README's current numbers: roughly 45 ms warm query time, zero LLM tokens per query, and 98.2% recall@5 on LongMemEval-S. The project is at v0.19.0 (September 29) with 268 stars, and its latest commit landed October 3.

The Hermes integration is the new part. It arrived as an October 1 commit and has two working modes:

  • Mode A: Uteke as an explicit tool. The agent calls remember and recall when it decides to.
  • Mode C: the uteke-memory plugin. It registers a pre_llm_call hook, so every turn the plugin recalls relevant memories by semantic search and injects them into the user message before the model sees it. No tool calls, no prompt gymnastics. Configuration knobs include a recall limit (default 5), a minimum score (0.40), a per-turn timeout, and a circuit breaker that pauses the hook after repeated failures.

A third mode, the memory-provider interface, was removed on June 29. The two current modes read the same store, and the docs recommend running both: automatic recall plus explicit writes.

What landed on October 1 is the committed plugin package at integrations/hermes. Tooling that scans repositories for installable plugins, including the Hermes Desktop "Install plugin" dialog, looks for plugin.yaml and init.py at the package root, and the committed package makes Uteke detectable. A CI drift guard fails the build if the committed files drift from the rendered templates.

Setup is two commands:

curl -fsSL https://codecora.dev/uteke/install | sh
uteke init --agent hermes

Then point Hermes at Uteke in its config:

memory:
  provider: uteke

If you prefer MCP over plugin files, hermes mcp add uteke --command uteke-mcp gets you the same store over JSON-RPC.

Where this does not help

Honesty section, because structural fixes have limits.

Local memory protects the memory layer, not the model layer. If your agent runs on a cloud LLM, your prompts still leave the machine for that provider. The full local stack is Uteke plus a local model, and the two pair fine on CPU hardware.

The paper's specific findings do not transfer to Hermes or Claude Code. The study tested consumer chatbot web and mobile clients. Use it as a reason to think about where your conversation artifacts go, not as evidence that coding agents leak the same way.

And if you need hosted sync across devices or team features out of the box, hosted memory services have real advantages there. Uteke's trade is different: the state lives on your disk, in a format you can inspect, and nothing moves unless you move it.

The interesting response is boring

The tracking study will keep making headlines, and regulators will do their thing at whatever pace regulators do. The response available to you today is smaller and quieter: keep the memory on your own disk, and let recall run before every turn without a third-party endpoint in the loop.