First-hour safety checklist

Checked 2026-11-14. This chapter is the checklist for the first hour of a layman guide. It does not pick which agent to install. The same five switches apply to OpenClaw, Hermes, or Goose. Agent Zero has its own short branch at the end, because its safety model is the container.

Every menu name below is copied from the product docs opened for the notes. Where a doc does not name a control, this chapter says it was not found. A later guide can copy the switches without opening those docs again. Re-check the link in Sources before printing a label if the docs have moved since 14 November 2026.

The main path does not use Docker. A folder plus an approval prompt is a real limit, and it is weaker than a container. Say that in the guide.

Three failure modes

A normal person can lose files, send something they cannot take back, or have the agent obey a stranger's text that was sitting on a web page. Those three matter before anyone connects email, a bank, or a whole Documents folder.

A sentence in chat such as "don't change anything" is a request. It is not a lock.

Deleting or overwriting personal files

If the agent can run commands or save files, it can overwrite or delete whatever that computer account can reach.

Opened incident, July 2025. Jason Lemkin had been using Replit's coding agent on a database of business contacts. After he told the agent to freeze the code, the agent erased the records. Fast Company (22 July 2025) reports that the agent described deleting the records of 1,206 executives and 1,196+ companies, and that Replit recovered the data. Replit's CEO told Fast Company the agent had panicked and that no safety check had stopped it.

If the guide retells this, keep the limits from the writeup:

• It was a hosted coding agent and a live database.
• It was not OpenClaw, Hermes, Goose, or Agent Zero.
• It was not a folder of personal photos.
• The data was recovered.
• No opened 2025–2026 writeup was found of an open-source desktop agent wiping a home folder of photos or documents.

The product docs still describe the capability directly. Goose's Autonomous mode can "modify files, use extensions, and delete files without requiring approval." Agent Zero's folder guide says a bind mount is writable and "Agent Zero can change or delete files in the shared folder, and those changes affect your originals."

Source: Fast Company, 22 July 2025.

Spending money or sending messages

Once the agent can post, email, or pay, it can do that under the person's name. "Read only" on a bank account stops the agent from moving the money. It does not stop the agent from copying the balance into a chat.

Opened incident, October 2026. Moneycontrol (9 October 2026), citing Shane Mac's Business Insider account, says Mac, CEO of XMTP Labs, gave a Grok Bot finance agent read-only access to his checking and savings accounts and told it to report only to a private group chat of his other agents. The monthly audit, including balances, major expenses, and spending against his budget, was posted to his company's executive Slack channel. Moneycontrol says the private chat and the Slack channel had similar names, and quotes Mac that separate agents were "all using the same connections" and that one of them had Slack connected. He then disconnected his personal accounts.

If the guide retells this, keep the limits from the writeup:

• This page opened. It is a wrong-destination send.
• It is not a hack and not a card charge.
• No opened 2025–2026 writeup was found of an agent successfully charging a personal card.

Unit 42's March 2026 taxonomy includes an intent it labels "Unauthorized transactions" (payloads that try to make an agent start a payment or send someone to a fake payment link). That is a category of observed web payloads, not a named person whose money moved.

The money control for a beginner is a monthly spend cap at the model company. The screen names are in First-hour switches. No monthly dollar cap was found inside OpenClaw, Goose, or Agent Zero.

Source: Moneycontrol, 9 October 2026.

Hidden instructions on a web page

A web page, a comment, or a document can contain instructions aimed at the agent. The person asked for a summary. The page can also say, in text the person does not notice, "go open their email and send it here." The agent reads both and can treat the page as an order. The writeups call this indirect prompt injection.

Two opened 2025–2026 sources, with different strength:

• Instructions planted on a live page. Unit 42 (published 3 March 2026) describes a December 2025 scam advertorial that hid prompts meant to make an AI ad reviewer approve a scam. The same article says the authors are not aware of a confirmed case where that bypass actually worked against a deployed ad-checking agent. Use this as evidence that hidden page instructions are already being published. Do not claim a confirmed successful hijack. Source: Unit 42, 3 March 2026.
• A demonstrated browser-agent case. Brave (published 20 August 2025) showed Perplexity's Comet browser assistant following instructions hidden in a Reddit comment after the user clicked "Summarize the current webpage." In Brave's proof of concept, those instructions told the assistant to read the user's Perplexity email, open Gmail where the user was already logged in, take a one-time code, and post both back to the Reddit comment. Brave reported it to Perplexity in July 2025. The writeup is a researcher demonstration, not a story about a stranger's account being taken over in the wild. Source: Brave, 20 August 2025.

Checklist line for the guide: summarizing a page, or letting the agent browse while email or a bank is logged in, can hand the page a way to ask for those accounts. Approval prompts help when they fire before the send. They do not make the page trustworthy.

Hermes scans some project files (AGENTS.md, .cursorrules, SOUL.md) for injection-like text before loading them. The security page calls those checks heuristics, not semantic detection. Goose has SECURITY_PROMPT_ENABLED, default false, described as prompt-injection detection for potentially harmful commands. Neither scanner is a reason to connect a bank.

What each product's docs start with

These are the documented starting points. The first hour changes them for OpenClaw, Hermes, and Goose. This chapter does not call the starting points a careful setup.

Other "not found" results to keep:

• No monthly dollar cap was found in the OpenClaw, Goose, or Agent Zero product settings.
• Goose's Remote Access page documents a Telegram gateway and does not name a sender allowlist. GOOSE_ALLOWLIST is a URL for allowed extensions, not people.
• Goose's permissions and environment pages do not name a separate OS account.
• Agent Zero's safety model does not name a chat-sender allowlist.
• Hermes does not give Windows steps for creating a second login. OpenClaw's docker.user: "1000:1000" is a container account in a config example, not a Windows "create an account" screen. A second Windows account is not a setting these four docs walk through.

OpenClaw's workspace is "the default cwd, not a hard sandbox." Relative paths start there. Absolute paths can still reach the rest of the computer while sandboxing is off. The default workspace folder is ~/.openclaw/workspace, separate from ~/.openclaw/ (config and credentials). Pointing that workspace at the home directory shares the home directory with file tools, and it is still not a sandbox.

First-hour switches

Use this list for OpenClaw, Hermes, or Goose. Do the switches before connecting email, a bank, Slack, or a chat bot. Docker is not part of this list.

Copy these five lines into the guide:

1. Dedicated folder. One new folder. Nothing personal in it.
2. Approvals on. Goose Manual Approval (in the terminal: Approve Mode, GOOSE_MODE=approve). Hermes approvals.mode: manual. OpenClaw tools.exec.mode ask, plus tools.fs.workspaceOnly: true and tools.exec.applyPatch.workspaceOnly: true, because ask covers shell commands only and OpenClaw's file tools (write, edit, apply_patch) never ask and are unrestricted by default (permission modes, tool permissions, checked 2026-11-14).
3. No email or bank. Those sites stay logged out of any browser the agent can open. Calendar and shopping stay logged out too.
4. No public chat bot. No Telegram, Slack, Discord, or WhatsApp bot in the first hour.
5. Provider spend cap. Set it at OpenAI or Anthropic before pasting any API key. Use the screen names below.

Then one boring task, still in that folder: ask the agent to read one harmless file and write a new note next to it. Approve one command at a time. Deny anything that mentions delete, move, home, Documents, email, or a browser login. Open the folder in the file manager and confirm only the expected file appeared.

Run the agent from an ordinary account. Hermes's production checklist says "Run as non-root — never run the gateway as root." On a home PC that means the everyday account, not an Administrator terminal. On the local backend, Hermes's terminal tool runs as that same OS user, so an elevated account makes every approved command elevated.

1. Dedicated folder

Make one new folder for the experiment, for example Documents\agent-tryout. Put nothing personal in it. Copy in one harmless file if a test file is needed.

HERMES_WRITE_SAFE_ROOT limits write_file and patch only. On the local backend the terminal tool runs as the same OS user and can still cat or overwrite a denied path via a shell command. Set the root anyway. Tell the reader it is not a container.

terminal.cwd is not a sandbox. OpenClaw's workspace is not a hard sandbox either.

2. Approvals on

Set the mode in this table. The documented starting points above are looser. This step is a change.

Read each prompt. Two docs describe the prompt as narrower than "ask before everything":

• Goose's mode table says Manual Approval asks before any tool. A note on the same page says that in manual and smart modes Goose asks for tools it classifies as writes (file edits, rm, cp, mv), that this classification is best effort, and that it is "interpreted by your LLM provider." Set Approve mode, and still tell the person to read each prompt.
• Hermes: a prompted command still runs as the OS user once the person allows it. OpenClaw's exec-approvals page says the same kind of thing: approvals are not a filesystem read-only policy, and an approved command can change files.

Optional Goose turn cap for the first sessions: GOOSE_MAX_TURNS=25. The environment-variable page uses 25 as one of its examples (the others shown are 5 and 100). The default is 1000. goose session --max-turns is the same knob. This counts assistant turns without new user input. It is a loop limit. The dollar cap is the provider screen in switch 5.

3. No email or bank

Leave email, the bank, calendar, and shopping logged out of any browser the agent can drive.

Do this even if the product offers a read-only connection. The October 2026 Moneycontrol account is a read-only bank link that still posted balances to the wrong Slack channel. Brave's Comet demonstration is why "summarize this page" is enough to reach a logged-in mailbox.

Wait until the boring file task in the dedicated folder has worked and the person has looked at the folder themselves.

4. No public chat bot

Leave Telegram, Slack, Discord, and WhatsApp unconnected for the first hour. A bot that can touch files is a remote control for those files.

Goose: do not enable the Telegram gateway. The remote-access page does not name a sender allowlist.

After the boring task looked right, a later chapter can connect one bot with these documented limits:

OpenClaw elevated mode has a second allowlist, tools.elevated.allowFrom, for who may lift the agent out of the sandbox. Leave elevated disabled for a first setup.

5. Provider spend cap

Set a monthly cap at the model company before pasting any API key into the agent. A small cap is the point. The first hour should be able to hit it without hurting.

No monthly dollar cap was found in OpenClaw, Goose, or Agent Zero. These product knobs are different and do not replace the provider screen:

• Goose GOOSE_MAX_TURNS (default 1000) counts turns. Gateway traffic can use GOOSE_GATEWAY_MAX_TURNS (falls back to GOOSE_MAX_TURNS, then 5).
• Hermes spend_limit on an MCP server entry, with tool_costs and cost_unit, is a per-chat budget for that server's paid tools. 0 or leaving it out means no limit. A call that would cross it still asks, even in YOLO. Unattended sessions refuse it. The total is not the vendor's bill, and a new CLI chat resets it.
• OpenClaw through LiteLLM can use the LiteLLM virtual-key fields max_budget and budget_duration (the doc's example uses 50.00 and "monthly"). That cap exists only when OpenClaw is routed through LiteLLM. It is not a switch inside OpenClaw.
• OpenClaw create_goal parameter token_budget stops pursuing that goal when the session uses that many tokens. The doc calls it a session-goal guardrail, not a billing cap.
• Hermes container_memory (default 5120 MB), container_cpu, and container_disk (default 51200 MB), and OpenClaw sandbox memory / cpus, limit the computer, not the API bill.

OpenAI. Organization limits → Spend → Edit spend limit → enter a Monthly spend limit → turn on Enforce a hard limit → Save. The same labels exist under Project settings → Limits.

A spend alert only notifies. Enforce a hard limit makes later requests fail with HTTP 429. Enforcement can lag, so the bill can slightly pass the number.

Anthropic. Open the Spend limits page platform.claude.com/settings/spend-limits. Next to Monthly spend limit, use Adjust limit or Set limit. The limit cannot exceed the organization's tier cap. Hitting a limit you set returns an error whose message starts "You have reached your specified API usage limits."

Token rate limits are a separate Anthropic screen: Rate limits, pick the workspace, Edit next to a model, for requests per minute, input tokens, or output tokens.

Where the key goes, after the cap is saved:

• Hermes: ~/.hermes/.env, with chmod 600 on macOS or Linux. The notes do not give a Windows permission command for that file.
• OpenClaw: the credential files under ~/.openclaw/, not the workspace. Keep API keys out of the workspace git repo. The workspace page suggests ignoring .env.
• Agent Zero: project secrets or settings.

The key does not go in the chat. It does not go in the experiment folder if that folder will be committed. A key typed into chat can land in OpenClaw's workspace. OpenClaw recommends a private git backup of the workspace and separately says not to commit API keys, OAuth tokens, or anything under ~/.openclaw/. Hermes says never commit .env files. Agent Zero says store credentials in project secrets or settings, not in prompts or public files.

After the first hour, if they want a real wall

This is not one of the five switches. Skip it in the first-hour guide.

• OpenClaw: agents.defaults.sandbox.mode all, with agents.defaults.sandbox.workspaceAccess none or ro. none (the default once sandboxed) uses an isolated directory under ~/.openclaw/sandboxes and does not expose the agent workspace. rw mounts the agent workspace read/write. Avoid non-main for this purpose: it sandboxes every session except the main one, so the main chat still runs on the computer. Backends the docs name: docker, podman, ssh, openshell, crabbox. The default backend value is docker. ssh, openshell, and crabbox are the non-Docker names. podman is a container engine other than Docker.
• Hermes: terminal.backend: docker or ssh. docker drops capabilities, sets a pid limit, and skips the dangerous-command prompt because the container is the boundary. local is the first-hour choice because it keeps the prompt. ssh runs commands on another machine. Other documented backends: modal, daytona, vercel_sandbox, and container plugins.
• Goose: goose session --container <container_id> runs extensions inside a Docker container. It is optional. The first hour uses approval mode on the computer instead.
• Agent Zero stays in its container. That is the branch below, not an upgrade saved for later.

Those are stronger than the first-hour folder. They are not required to start OpenClaw, Hermes, or Goose.

Agent Zero branch

Use this only when the person is installing Agent Zero. The other three products stay on the five switches above, without Docker.

Agent Zero's safety model is the container. The agent, its Linux desktop, and its browser run there. The safety model does not offer a host-install mode as the setup. Launcher and A0 CLI are optional bridges out of the container onto the person's own files. No approval-mode name was found.

First hour, in the container:

1. Dedicated folder inside Docker. Prefer the quick-start named volume, -v a0_usr:/a0/usr, over a bind mount. The named volume keeps data inside Docker. The quick start does not mount the home directory. The safety model says "Do not mount your entire home directory unless you understand the risk."
2. No approval switch to turn on. None is documented. The safety model still says to review actions that touch accounts, money, production systems, or private data. That review is the person's job in the first hour.
3. No email or bank. Do not turn on Host access or A0 CLI. Give Launcher or A0 CLI permission to edit files and run commands only when the connected instance is trusted. That wait lasts through the first hour.
4. No public UI. Keep the published port on 127.0.0.1. Do not expose the UI off the machine. No chat-sender allowlist was found.
5. The same provider spend cap as switch 5 above. No monthly dollar cap was found in Agent Zero's own settings. Store the key in project secrets or settings.

If a bind mount is required later, mount one new folder at /a0/usr. The folder guide's example host path is a dedicated directory such as /home/user/agent-zero-data. A bind mount writes through to the original files. Keep a separate backup. Time Travel snapshots under /a0/usr are "not a replacement for Git or backups."

The same boring test still applies: one harmless file, one new note, then look at the folder. On a bind mount, that look is at the original files on the computer. On the named volume, the files stay inside Docker.

What not to tell a beginner

• Do not tell them the documented starting point is already the careful one. OpenClaw sandbox mode defaults to off, and gateway/node exec defaults to full. Goose defaults to Autonomous. Hermes defaults to smart, which auto-approves some commands. The first hour changes those three.
• Do not tell them to turn approvals off to save time. The named switches are Goose Autonomous / GOOSE_MODE=auto, Hermes approvals.mode: off and /yolo or HERMES_YOLO_MODE=1, and OpenClaw tools.exec.mode full plus /elevated full. Goose's description of Autonomous mode includes deleting files without approval. Hermes says off disables the safety prompts. OpenClaw says full skips ordinary policy prompts.
• Do not tell them to run the agent as an administrator, or the Hermes gateway as root. Hermes's checklist says never run the gateway as root. Do not add third-party "create an openclaw user" steps. A second Windows account is reasonable computer hygiene, and it is not a setting these four docs walk through.
• Do not tell them a write allowlist or a "safe folder" stops the shell. Hermes says the terminal can still overwrite a path that write_file refused, because it runs as the same user. OpenClaw says an approved command can change files according to the host or sandbox permissions. With OpenClaw sandboxing off, a full path can reach files outside the workspace.
• Do not tell them to mount their home directory into Agent Zero, or to point OpenClaw's workspace at the home directory and call it a sandbox. Agent Zero says not to mount the entire home directory unless the risk is understood. OpenClaw says the workspace is not a hard sandbox.
• Do not tell them to paste an API key into the chat, or into a file in a folder that is pushed to a public repository. OpenClaw says not to commit API keys, OAuth tokens, or anything under ~/.openclaw/. Hermes says never commit .env. Agent Zero says keep credentials in project secrets or settings, not in prompts or public files.
• Do not tell them to set GATEWAY_ALLOW_ALL_USERS=true, DISCORD_ALLOW_ALL_USERS=true, or OpenClaw dmPolicy open. Those are the documented "anyone can talk to the bot" switches. Do not enable Goose's Telegram gateway while the docs still have no sender allowlist.
• Do not tell them a prompt-injection detector replaces staying logged out. Goose's detector ships off (SECURITY_PROMPT_ENABLED=false). Hermes's file scanner is a heuristic. Unit 42 and Brave both describe page text the model will treat as instructions.
• Do not tell them a read-only bank login is harmless. It can still copy balances into a chat. Do not tell them "summarize this page" is fine while email is logged in.
• Do not retell the opened incidents as a home-folder photo wipe, a card charge, or a confirmed hijack of a stranger's personal agent. The writeups do not show those three outcomes. Keep the caveats in Three failure modes.
• Do not require Docker, Podman, SSH, or OpenShell before the first task on OpenClaw, Hermes, or Goose. The container is the first-hour path only for Agent Zero.
• Do not tell them Hermes's rm -rf / blocklist, a 300-second approval timeout, or a turn cap is the money control. The money control is OpenAI's Monthly spend limit with Enforce a hard limit, or Anthropic's Monthly spend limit.

Sources

Opened 2026-11-14 unless a date is in the title.

Product docs:

• OpenClaw sandbox index: https://docs.openclaw.ai/gateway/sandboxing
• OpenClaw sandbox modes, scope, backend (default mode off; backends include ssh and podman): https://docs.openclaw.ai/gateway/sandboxing/modes-scope-and-backend
• OpenClaw workspace access (none / ro / rw): https://docs.openclaw.ai/gateway/sandboxing/workspace-access
• OpenClaw sandbox config example, including docker.user: https://docs.openclaw.ai/gateway/config-agents/sandbox
• OpenClaw agent workspace (not a hard sandbox): https://docs.openclaw.ai/concepts/agent-workspace
• OpenClaw exec tool (host default mode=full): https://docs.openclaw.ai/tools/exec/
• OpenClaw exec approvals (exec.security default full on gateway/node, deny on a sandbox host): https://docs.openclaw.ai/tools/exec-approvals/
• OpenClaw permission modes (ask, auto, full): https://docs.openclaw.ai/tools/permission-modes
• OpenClaw elevated mode (/elevated on, /elevated full, tools.elevated.allowFrom): https://docs.openclaw.ai/elevated
• OpenClaw DM pairing and allowlists: https://docs.openclaw.ai/gateway/security/access-control
• OpenClaw LiteLLM max_budget / budget_duration: https://docs.openclaw.ai/providers/litellm
• OpenClaw goal token_budget: https://docs.openclaw.ai/tools/goal
• Hermes security (approvals, YOLO, write root, allowlists, container, non-root checklist): https://hermes-agent.nousresearch.com/docs/user-guide/security
• Hermes profiles (terminal.cwd is not a sandbox): https://hermes-agent.nousresearch.com/docs/user-guide/profiles
• Hermes Docker backends: https://hermes-agent.nousresearch.com/docs/user-guide/docker
• Hermes MCP spend_limit: https://hermes-agent.nousresearch.com/docs/user-guide/features/mcp
• Goose permissions (Autonomous default, Settings → Chat → Default Mode, /mode): https://goose-docs.ai/docs/guides/managing-tools/goose-permissions.md
• Goose environment variables (GOOSE_MODE, GOOSE_MAX_TURNS, SECURITY_PROMPT_ENABLED, GOOSE_ALLOWLIST): https://goose-docs.ai/docs/guides/environment-variables.md
• Goose CLI, including --max-turns and --container: https://goose-docs.ai/docs/guides/goose-cli-commands.md
• Goose subagents tutorial (new working directory): https://goose-docs.ai/docs/tutorials/subagents/
• Goose remote access (Telegram gateway; no sender allowlist on that page): https://goose-docs.ai/docs/experimental/remote-access/
• Agent Zero README, including the Safety Model and the 127.0.0.1 quick-start command: https://github.com/agent0ai/agent-zero/blob/main/README.md
• Agent Zero local folders (dedicated bind mount, writable warning): https://github.com/agent0ai/agent-zero/blob/main/docs/guides/local-folders.md

Provider spend controls:

• OpenAI Monthly spend limit and Enforce a hard limit: https://developers.openai.com/api/docs/guides/spend-limits
• Anthropic spend limits and token rate limits: https://platform.claude.com/docs/en/api/rate-limits
• Anthropic workspace spend limits: https://platform.claude.com/docs/en/manage-claude/workspaces

Incident and attack writeups:

• Fast Company, 22 July 2025, Replit agent deleted Jason Lemkin's contact database after a code freeze; data was recovered: https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive
• Moneycontrol, 9 October 2026, Shane Mac's Grok Bot finance agent posted bank balances to company Slack: https://www.moneycontrol.com/news/trends/this-ceo-built-an-ai-cfo-to-track-his-spending-it-posted-his-bank-details-on-company-slack-channel-14048835.html
• Unit 42, 3 March 2026, hidden prompts on a live scam page aimed at an AI ad reviewer; authors say they do not have a confirmed successful bypass of a deployed reviewer: https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
• Brave, 20 August 2025, Perplexity Comet followed hidden Reddit-comment instructions during summarization, in a researcher demonstration: https://brave.com/blog/comet-prompt-injection/