“Fully automated AI sales agent”: How to tell a real tool from an autopilot promise

“Fully automated AI sales agent: finds leads, contacts them, follows up while you sleep.” Managing directors are currently running into promises like this a lot, in videos, on sales pages and in agency proposals. The name of a real open-source project often appears alongside them. That makes the pitch more credible, because the project does exist. But the decisive question is this: Can the project actually do what the sales page promises?

We checked this against a current example: the AI agent “Hermes Agent” from Nous Research and a sales page that promotes fully automated lead research and outreach under the name “Hermes.” This article shows what the sources say and what they do not, which legal question immediately arises with automated first contact by email, and how you can recognize a solid offer. It is not an assessment of individuals. It is a guide to checking claims before you spend money.

What Hermes Agent is, according to the project page

The project page on GitHub (github.com/NousResearch/hermes-agent, retrieved on October 21, 2026) describes Hermes Agent as “The self-improving AI agent built by Nous Research,” with the tagline “The agent that grows with you.” The license is MIT, so the code is freely usable. Among the features, the page lists a terminal interface, a messaging gateway via Telegram, Discord, Slack, WhatsApp and Signal, a “learning loop” with memory and automatically created skills, a built-in scheduler for recurring tasks, parallel sub-agents and several execution environments, including local, Docker and via SSH. Various language model providers can be connected.

This is a serious project, and according to this description it is a general-purpose personal agent. What does not appear on the page is just as revealing: lead generation, sales, marketing, sending email to prospects or a specific provider for email addresses are not mentioned. “Email” appears only in a table as one of several messaging platforms, that is, as a communication channel, not as a feature for acquisition.

That is not a shortcoming of the project. It only means that a general-purpose agent can be set up for many things with tools and skills. That it can do so does not mean that someone has built it in a finished, secure and legally sound way.

What the security policy says about responsibility

The project’s security policy (SECURITY.md) is instructive. It describes Hermes Agent as a “single-tenant personal agent,” that is, an agent for one individual or one operator, not a multi-tenant service for many customers. The only security boundary against a hostile language model is the operating system. Everything that runs inside the agent process itself, including the approval prompt, the redaction of sensitive data and the vetting of skills, is not considered containment.

On command approval, it states that an “approval gate” detects common destructive shell patterns and asks the operator before execution. However, it is a heuristic and not a security boundary. It catches mistakes in cooperative operation, but not deliberately manipulated outputs. Bypasses of this heuristic are not treated as a security vulnerability.

In addition, there is a list of what the operator must do: choose isolation to match the trustworthiness of the inputs, not run the agent as an administrator, store credentials properly, maintain an allowlist for every network-connected access point, not expose the agent unprotected to the open internet, and vet third-party skills and extensions before installing them. Approvals that have been deliberately turned off are the operator’s decision.

The project is honest about its limits: Responsibility for a secure setup lies with the operator. Anyone selling a “ready-made autopilot” on this basis does not automatically take on that responsibility for you.

For a company that contacts prospects by email, this is the crux: Between “the tool exists” and “the workflow is reliable” lies work that someone has to do and responsibility that someone has to bear.

What the sales page promises

We also read the sales page (aisuccesslabjuliangoldie.com/blog/best-hermes-agents, retrieved on October 21, 2026). There, “Hermes” is described as “Julian Goldie’s agent OS,” which can be used to build “focused AI agents that do one job brilliantly.” It is offered together with training in a paid community. Whether the system called “Hermes” there is identical to the open-source project from Nous Research cannot be determined from the pages we read. We therefore do not claim that it is.

The page describes two types of agents. A “lead research agent” is supposed to find and qualify prospects “while you sleep,” with a scraping and browser capability as well as enrichment via an email finder. The example given is a search for dentists in Manchester without a modern website. This is said to be sold for 500 to 2,000 pounds per project. An “outreach agent” reportedly writes personalized messages, sends them by email or LinkedIn and follows up twice. The recommendation is 20 messages per day, with a price of 1,000 to 3,000 pounds per month. In the exit popup, the full package is listed at “$69/mo,” and a 7-day refund and a 30-day ROI guarantee are also mentioned.

This is a description of business models for agencies that are meant to resell such agents to their clients. It is not the description of a vetted product for your mid-sized business in Germany. Note that the examples come from the United Kingdom and that the page says nothing about German competition law.

When figures on a page contradict each other

A second test is the figures used to build trust. On the same sales page, different values are given for the same metric: The community’s member count appears in several places as “3,400+,” but in the author box as “3,600+.” YouTube reach is stated once as “400,000+ subscribers” and elsewhere as “70,000+ people follow my AI work on YouTube.” In addition, the footer states “4.9 out of 5 from 114 member reviews,” while twelve reviews are visible on the page.

We draw no conclusion from this about intentions. We draw a conclusion about reliability: All of these figures are self-reported on a sales page, they are not independently verified, and several of them contradict each other on the same page. They are not suitable as a basis for a budget decision. This applies to every provider, not just this one: Figures that the seller states about itself are a claim, not evidence.

The legal question every autopilot must answer at first contact

Even if the technology works flawlessly, one question remains for the German market that rarely comes up in sales videos: Are you even allowed to send this email? Section 7 of the German Act against Unfair Competition (UWG) declares unreasonable nuisances impermissible. Subsection 2 number 2 names as an example advertising “using an automated calling machine, a fax machine or electronic mail” (“unter Verwendung einer automatischen Anrufmaschine, eines Faxgerätes oder elektronischer Post”) without the “prior express consent of the addressee” (“vorherige ausdrückliche Einwilligung des Adressaten”). Email is electronic mail. The wording we read on dejure.org does not distinguish between consumers and businesses at this point. Exceptions, for example for existing customers, are governed by Section 7 (3). We have not examined them, and this article is not a substitute for legal advice.

For your practice, this means: A workflow that “finds leads and contacts them automatically” must be able to answer, before the first send, on what basis the recipient may be contacted. “The address was publicly findable” is not consent. We have a separate article on a related point: According to reports on a ruling by the Düsseldorf Local Court (Amtsgericht Düsseldorf), a LinkedIn connection is not consent to advertising. That also applies when an agent writes the message.

On top of that comes the data protection question. An agent that collects and enriches contact data processes personal data. Where does it come from, where is it stored, who has access, and how quickly can an objection be enforced? These are questions about the workflow, not about the language model.

How to recognize a solid offer: seven checking questions

From this example, we can derive a checklist that works for any sales “autopilot” offer:

1. Who is behind it? Is there a company with a legal notice, a contact person and a contract, or just a channel and a community?
2. Is there documentation? Does it state in writing what the system does, which data sources it uses and what it does not do?
3. Does the claim match the source? If an open-source project is named: Does its own page describe the promised function? Here, it does not.
4. What legal basis does the first contact use? How are consent, objection and block list implemented?
5. Who sees the message before it is sent? Is there an approval step for every first-contact email, at least at the start?
6. How can the workflow be stopped? Can someone pause it with one click, and does that take effect immediately?
7. What evidence exists independent of the provider? References you can call yourself, instead of figures on the provider’s own page.

The more of these questions remain open, the more the offer shifts its risk onto your side. When emails are sent in your company’s name, this is no minor detail, because the sender is you.

Availability: What is usable now and what is not

A clear separation helps:

• Hermes Agent as an open-source project: generally available, MIT license, usable worldwide, and therefore in Germany, Austria and Switzerland. It is a general-purpose personal agent that you have to set up and secure yourself.
• A “fully automated lead outreach” on this basis: according to the sources we read, not a confirmed, standalone product. We found it neither described on the project page nor independently documented. For availability in DACH, the answer is: unknown.

That is how you should treat the promise: not as something you can book today and let run, but as a kind of offer that is coming toward companies and that you check with the questions above. If you want to prepare something now, you can define your target audience, legal basis and approval. This work remains useful regardless of which tool ends up behind it.

Which agent at Amazing Agents is responsible: Kai and Michael

On amazing-agents.com, this topic belongs to the outreach team. Kai is described there as the outreach lead: He defines strategy, industries, sequences, tone and channels. Michael is the lead sourcing specialist, who researches companies and decision-makers in public sources and hands over each contact with a concrete hook, rather than just an address. The website describes that the workflow can be paused at any time, that opt-outs are respected immediately and permanently, that Kai observes LinkedIn limits and that EU-hosted data sources are used. Kai himself says clearly there what he is not: no substitute for relationship building and no trick against poor offers.

Beyond the individual agents, the website’s general framework applies: Every agent runs within a defined framework with approval steps for critical actions, and emails are, for example, created as drafts, not sent directly. Kai’s workflow is described on the page as a pipeline up to sending. For first contact, we recommend as a basic rule that a person sees every email beforehand. That is our recommendation for practice, not a statement about a product setting.

With and without an approval step: the difference at first contact

Without an approval step, an autopilot sends emails to addresses it has found somewhere, without any person having seen the text, recipient or legal basis beforehand. Errors, such as a wrong company name, an unsuitable hook or a recipient who objected long ago, are repeated many times over before anyone notices. The damage hits the sender, which is you.

With an approval step, a person sees every first-contact email before it is sent. The agent does the groundwork: target audience, research, hook, draft. The person checks whether the approach, recipient and legal basis are right, and approves or corrects. It takes longer than an autopilot, but you know what goes out in your name. As experience grows, you can define which parts to loosen later, and that decision is then yours.

What you should prepare now

Because a “fully automated sales agent” is not a confirmed product according to the sources, preparation comes before use. Three steps are enough to start:

1. Describe your target audience in five sentences. Which companies and roles do you want to reach, and why should they be interested? If you cannot do that in five sentences, you cannot teach it to an agent either.
2. Clarify the legal basis. Work with your legal counsel to determine on what basis first contact by email and LinkedIn is permissible, and how objection and block list work.
3. Define the approval. Decide who sees every first-contact message before it is sent, and who may pause the workflow.

How we verified what this article says

The information on Hermes Agent comes from the GitHub project page and its security policy, the information on the sales page from the page itself, and the information on Section 7 UWG from dejure.org. All were retrieved on October 21, 2026. What does not appear there, we removed. This includes claims we encountered beforehand: that a specific email finder service is part of the setup, and statements on the number of videos promoting the topic. We found the first on none of the pages we read; the second we did not verify. A generalization to other providers is not intended. The article does not assess individuals, only what the named pages say and what they do not.

The difference that matters

Real tools exist, and good agents in sales can do a lot of groundwork: researching, sorting, writing drafts. The difference lies not in the technology but in the framework. An autopilot keeps going even when something goes wrong. An agent with limits and an approval step prepares, shows you the result and waits for your okay before anything goes out in your name.