A Mac mini running OpenClaw or Hermes Agent is a small server with a lot of authority. It stays on, it holds API keys and chat tokens, and it acts while you sleep. Treat it like a production box: isolate the agent's user, keep it off the public internet, put a supervisor in front of it, and decide in advance how you will stop it.
This guide is the machine-level setup, with Beam where it fits. Where Beam does not cover an agent, we say so. Beam hooks cover specific coding agents; they do not cover OpenClaw or Hermes Agent today.
| Question | Short answer |
|---|---|
| Where should the agent run? | Under its own standard (non-admin) macOS user, not your daily account. |
| How do I reach the Mac mini? | Tailscale for SSH and Screen Sharing. No router port forwards. |
| Does Beam hook OpenClaw or Hermes? | No. Beam's agent adapters are Claude Code, Codex, Cursor, Copilot CLI and Gemini (best-effort), plus OpenCode discovery. |
| What does Beam give me on the Mac mini? | beam service under launchd, dashboard device status and version, remote update, revocation, hooks for any coding agent on the box, and beam monitor for logs. |
| What is the kill switch? | Stop the launchd job, cut the network, revoke keys, revoke the Beam device. |
Why people run agents on a Mac mini
A Mac mini is quiet, cheap to run and powerful enough that the model call, not the machine, is the bottleneck. explainx.ai's comparison of the two agents says both run comfortably on a small VPS or a Mac mini for personal use and need no local GPU, because inference goes to a configured provider. Their five-way comparison puts the same agents beside the hosted assistants, and the Hermes setup guide covers running it on a remote machine and driving it from Telegram.
That convenience is the risk. Kaspersky's write-up of the OpenClaw vulnerabilities describes an assistant that keeps configuration, memory and skills in local Markdown files it can modify itself. An agent that edits its own instructions and reads untrusted messages is exactly what a Telegram-driven agent looked like in Unit 42's BUGSTER case, where an attacker used one to run crime. Same tooling shape, different owner.
Step 1: Give the agent its own macOS user
Create a standard user (System Settings, Users & Groups) named something like agent. Install and run the agent there, not under your account. You get a separate home folder, keychain, browser profile and shell history. A prompt injection that tells the agent to read ~/.ssh finds the agent user's ~/.ssh, not yours.
Then turn on the basics for the machine:
# FileVault on, firewall on
sudo fdesetup status
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Come back by itself after a power cut
sudo pmset -a autorestart 1
# Stay awake on power; the display may still sleep
sudo pmset -c sleep 0
Two honest caveats. FileVault encrypts at rest but means a reboot waits at the pre-login screen unless you accept the trade-offs of auto-login, so decide that deliberately and test a reboot. And a non-admin user limits damage; it is not a sandbox. The agent can still use everything that user can reach, including whatever API keys you give it.
Step 2: Reach it without opening it
Do not forward ports from your router. Install Tailscale on the Mac mini and on your laptop, enable Remote Login and Screen Sharing in System Settings, and connect over the private address:
ssh agent@mac-mini # MagicDNS name on your tailnet
open vnc://mac-mini # Screen Sharing from your laptop
Our Tailscale guide walks through the private-network pattern for a VPS, and the same ideas apply. If the agent exposes a webhook or web UI, put it on the tailnet or behind a tunnel rather than a public port. Symantec's Skynet-mode report is a reminder of what happens to exposed agent endpoints.
Step 3: Supervise the agent with launchd
Run the agent as a launchd job so it restarts after a crash and you have one command to stop it. The plist below uses placeholders; use the start command from your agent's own documentation. Save it as ~/Library/LaunchAgents/com.example.agent.plist for the agent user:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key><string>com.example.agent</string>
<key>ProgramArguments</key>
<array><string>/path/to/agent</string><string>--your-args</string></array>
<key>RunAtLoad</key><true/>
<key>KeepAlive</key><true/>
<key>StandardOutPath</key><string>/Users/agent/logs/agent.log</string>
<key>StandardErrorPath</key><string>/Users/agent/logs/agent.err</string>
</dict>
</plist>
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.example.agent.plist
launchctl print gui/$(id -u)/com.example.agent | head
launchctl bootout gui/$(id -u)/com.example.agent # the stop button
A LaunchAgent belongs to a logged-in user session. A Mac mini that must run with nobody at the keyboard needs that session to exist (auto-login for the agent user, with the physical-access trade-off), or a different supervisor you have verified yourself. Reboot once and confirm the agent comes back.
Step 4: Put Beam on the Mac mini
Install Beam as the same user that runs your coding agents, then pair it with your workspace. The standalone installer is a download you can read first:
curl -fsSL https://agentbeam.com/install.sh -o /tmp/beam-install.sh
less /tmp/beam-install.sh
bash /tmp/beam-install.sh
export PATH="$HOME/.local/bin:$PATH"
beam connect # prints a URL; open it on your laptop and confirm
beam agent list
beam agent install-all
beam service install # launchd: ~/Library/LaunchAgents/ai.beam.collector.plist
beam service status
The service guide says the macOS service is a user launch agent with RunAtLoad and KeepAlive, which restarts the collector after a crash but is not system-wide enforcement. The pairing URL contains a one-time token, so keep it out of screenshots. If you run Claude Code or Codex on the Mac mini, install-all wires their PreToolUse hooks and policy deny applies to them. The Raspberry Pi walkthrough is the same flow on Linux, including opening Studio through an SSH tunnel with ssh -N -L 4319:127.0.0.1:4319 agent@mac-mini.
What Beam sees, and what it does not
| Agent on the Mac mini | What Beam captures |
|---|---|
| Claude Code, Codex | Tool calls through PreToolUse hooks; workspace policy can deny. |
| Cursor, Copilot CLI | Tool calls captured; the blocking response is not wired. |
| Gemini CLI | Best-effort adapter, not verified. |
| OpenClaw, Hermes Agent | No hook adapter. Beam does not see their tool calls. |
| Any process | Device registration, Beam version, and (with beam monitor) whatever you pipe from its logs. |
That OpenClaw and Hermes row is the honest gap. For those agents, the machine-level controls in steps 1 to 3 and the kill switch below carry most of the weight. You can also tail their logs through Beam, which sends redacted findings to the workspace:
beam monitor --file /Users/agent/logs/agent.log --file /Users/agent/logs/agent.err
beam monitor is built for application logs and web traffic, so its rules look for attack patterns and secrets in lines rather than judging agent decisions. Treat it as a tripwire for an exposed gateway or leaked credentials in logs, not an audit of what the agent chose to do. It never blocks or changes the application.
Step 5: Check the fleet from the dashboard
In the Beam dashboard, Devices & agents lists each connected device with its last-reported Beam version. Owners, administrators and security managers can queue an update to the latest release for a device or choose Update all behind; the device installs it at its next poll. Revoking a device removes its remote access, not its local installation or historical records.
Registration is not health. The dashboard guide says a registered device does not prove continuous capture, a healthy hook or complete forwarding. Compare recent local activity in Studio with the dashboard when a device goes quiet. If your Mac minis are part of a managed fleet, Beam's device management adds inventory and guarded lock and wipe actions, but it is in beta and needs your own enrollment and validation first.
The kill-switch ladder
Write this down and test it once on a quiet afternoon. Each rung is stronger and slower to undo:
- Stop the agent.
launchctl bootout gui/$(id -u)/com.example.agent, or quit the agent from an SSH session. - Cut its network. Disconnect the Mac mini from your tailnet and turn Wi-Fi off. An agent with no network cannot reach its model provider, chat channels or your accounts.
- Revoke what it held. Rotate the model API keys, chat bot tokens and any OAuth grants the agent user had. Stopping the process does not invalidate a key that was already copied.
- Retire the device in Beam. Revoke it in Devices & agents, then follow the offboarding guide to remove hooks and local data.
- Inspect before reuse. Review the agent's memory and skills files for changes you did not make before restarting anything.
Rung 3 is the one people skip. Use a separate API key for the agent with a spending cap, so revoking it affects only the agent.
What this setup does not do
- It is not a sandbox. A non-admin user, a firewall and a private network reduce blast radius. They do not stop the agent from using what it has been given.
- Beam does not see OpenClaw or Hermes tool calls. Only agents with a Beam adapter are captured, and only Claude Code and Codex have policy deny wired.
- Hook-based deny is not a kernel boundary. For stronger isolation, run the agent in a VM or container; see our look at VM sandboxes for coding agents.
- Prompt injection is not a network problem. If the agent reads email or chat, text inside a message can steer it. The agentjacking write-up shows how, and the practical mitigation is read-only access to untrusted content.
For the monitor-versus-block trade-off, see monitoring versus blocking, and for rolling this out beyond one machine, the enterprise rollout checklist.
Related reading
- What is AI agent monitoring?
- Run Beam on a Raspberry Pi
- BUGSTER: an attacker's Hermes Agent setup
- Keep Muse, Dots, Claude Duet and Grok Bot safe
- Microsoft's guardian agents: treat agents as insiders
- explainx.ai: Hermes Agent vs OpenClaw and OpenClaw on the explainx.ai directory
Commands and Beam behavior checked against Beam's documentation on October 26, 2026. OpenClaw and Hermes Agent start commands and security status change quickly; confirm them in each project's own documentation before relying on this.