Writing with my AI co-pilot: how I run a security blog with Hermes, and why disclosure beats co-authorship

My blog has been running for some time now. The workflow that builds it is new, and this post is the first to introduce it. I wrote the pipeline, and Hermes, an open-source agent from Nous Research ¹, runs it on schedule. This post covers the moving parts and then takes the position: I disclose the tool. I do not list it as a co-author.

The parts that follow go inside the machinery, one moving part each: the topic queue and its priority classification, the draft factory, the publish gate, and the standing guardrails, with this post as the map.

The pipeline

The site runs on my homelab: a Hugo build in Docker, nginx in front, and a handful of scripts between the two. I schedule two cron jobs. A research job tops the topic queue at five entries daily and flags time-sensitive items, like an actively exploited CVE, as priority. A draft job runs every morning: on the two draft days it takes the top of the queue, and on the other days it takes a priority item when one is waiting. It verifies the claims with web searches and writes a full post to a staging directory. I approve a draft in chat, and a deploy script takes over from there: it validates the file, copies it to the web server, waits for Hugo to rebuild, and checks the live URL.

The staging directory holds the source of truth. The agent reads it before it acts and writes back to it after. It keeps no conversation state across sessions. Files hold the history, so a fresh session recovers everything from disk.

The division of labor

Hermes writes the first pass. I decide what ships. The agent writes the draft and pulls the sources. I set the topic list, edit the prose, and reject drafts that miss the mark. Before it cites a page, the agent loads it. If it cannot load the page, it drops the claim. I read every draft before it publishes, and the rule holds after publication too: if a post turns out to be wrong, it comes down.

The model runs locally on my homelab: a dense 27B-parameter model with MTP speculative decoding on the GPU. The agent sees the filesystem, runs commands, and calls tools the way I would. The guardrails around that access are the interesting part.

Verification beats confidence

An LLM draft fails in one way: it invents a plausible version number, a real-sounding CVE, a quote with no source. My countermeasure is boring: every factual claim traces to a page the agent loaded, and every metric comes from a run I can reproduce. The deploy script checks the live URL after each publish, and a failed check keeps the post in staging.

The checks cut both ways: I hold the agent to loaded sources, and it re-reads a config file before it edits one, because I change those files in parallel. It lists a directory before it deletes anything. I have watched it assume its way into a broken state when I let a step skip the check, so the rules sit in its standing instructions and it applies them every time.

Why disclosure beats co-authorship

AP updated its newsroom standards for AI in July 2026 ². The service permits journalists to use AI for early research, document summarization, transcription, translation, and language cleanup. Every output gets a human review before publication, and the standards require disclosure when AI plays a material role in the work. In 2023 the position was stricter: AI could not create publishable AP content at all ³. AP moved from a ban on AI-written content to a framework of human review plus disclosure. That is the standard I hold to.

The EU AI Act follows the same logic. Article 50, which began applying on August 2, 2026, requires deployers to disclose AI-generated text published to inform the public on matters of public interest ⁴. The article carves out an exception: content that passed human review or editorial control with a person holding editorial responsibility for the publication. A one-person blog that reviews every post fits that exception. I disclose anyway, because co-authorship gets the agency wrong. I choose the topics, set the rules, verify the sources, and pull the post when it errs. The tool executes. Listing it as a co-author would suggest a partnership of equals and hide that one person owns every claim in the text. Disclosure names the tool, names me as the owner of the output, and leaves you to judge the work on its merits.

The line I hold

One rule shapes everything the pipeline ships. My day job runs in an environment with a specific stack and specific queries, and the rule keeps them out of the posts: work details stay generic in prose, “my environment,” “our mail gateway.” This homelab is mine, so I describe it in full, down to the hardware and the local model. The split is one sentence in the agent’s standing instructions, and it keeps a personal blog from becoming a leak channel for my employer.

The pipeline drafts, I verify and publish, and the byline stays on me. The disclosure stays with it, because that is the arrangement I want readers to see: one person owning every claim in the text, with the tool named right next to it.