Can an AI Agent Run Your Social Media? Honest Answer

Can an AI agent run your social media?

An agent can run the factory — research, captions, media attach, scheduling, a Friday analytics note. It cannot run the brand. If you skip the human, you will eventually publish something you have to explain.

That is the whole article. The rest is the split, the stack, the failure I keep seeing on X, and a weekly loop that survives contact with a real account.

I build Social by InstantDM. We are the publisher in the examples: dashboard for you, MCP for the agent, same pipeline. I have a bias toward drafts, because the posts that go out through our API have our fingerprints on the logs even when the words are yours.

Agents overview on Social by InstantDM, captured 28 August 2026. Agent-as-producer is a product surface. Agent-as-unattended-mouth is not.

Short answers to the questions people actually mean:

• “Can it write the captions?” Yes.
• “Can it queue them?” Yes, as drafts or as scheduled posts you reviewed.
• “Can it hit eight networks without me?” Technically, if you hand it publish_now. You should not.
• “Can it reply to comments as me?” Not in any setup I will help you ship.
• “Can it replace my social media manager?” It can replace the swivel-chair. It cannot replace taste, crisis, or community.

If those distinctions annoy you, you wanted a slot machine with a logo on it. I do not sell that.

What can an agent actually do well in 2026?

With OpenClaw or Hermes connected to a scheduler over MCP:

• Turn a changelog or blog into five platform-native drafts
• Keep LinkedIn long and X short via platformContent
• Put Instagram at 11:00 and LinkedIn at 08:00 via platformSchedules
• Upload a public image URL so you are not pasting Drive preview links
• List what is already queued, reschedule, pull analytics
• Remember voice from SOUL.md instead of a Notion page you forgot to paste
• Wake on a weekday cron, file drafts, ping Telegram with post IDs

Those are mechanical. Language models plus a picky API wrapper beat a tired human on Sunday night at the swivel-chair between ChatGPT and Buffer.

A worked prompt that produces useful drafts:

Read SOUL.md. Here is this week’s changelog. Write five drafts: LinkedIn (long, one claim), X (under 260, no hashtag salad), Instagram (line breaks, media required), TikTok (short on-screen text + caption), Facebook (plain). draft: true. Use platformContent. Do not publish. Return post IDs.

What “well” does not mean: original reporting, a partnership announcement with legal language, or a joke about a tragedy the model has not understood. The factory is captions and queues. The brand is still you.

Numbers I will stand behind, checked 27 August 2026:

• OpenClaw: 387,774 GitHub stars, 81,423 forks, MIT, TypeScript Gateway on port 18789
• Hermes Agent: 237,120 stars, ~48k forks, Nous Research, Python, v0.20.5 (v2026.8.19)
• Neither posts natively to Instagram / LinkedIn / TikTok

The star counts tell you lots of people installed an agent. They do not tell you lots of brands should auto-publish.

OpenClaw at openclaw.ai, captured 27 August 2026. A personal assistant in chat. The feed is a different system.

Hermes Agent at hermes-agent.nousresearch.com, captured 27 August 2026. Cron and a learning loop. Still needs a publisher.

Claude, ChatGPT, Codex, Cursor, Grok — if they speak MCP, they can call the same tools. Schedule from Claude or ChatGPT. The agent is interchangeable. The publisher is not. Personal agent vs social publisher.

What should an agent not do, even if the tools exist?

Should cron call publish_now?

No. Always-on plus irreversible equals 3am incidents. Cron may create drafts and ping you. It may not go live on its own. Our skill forbids this. Put it in SOUL.md anyway.

Should it invent numbers?

No. If get_analytics did not return it, it does not go in a caption. “10,000 customers” from a blog the model half-read is how you get a screenshot in a competitor’s reply.

Should it reply to comments or DMs as you?

Not until you have a review queue. Commitment language is legal, not copy. “We’ll refund you” in a public reply is a contract. I build a different product for Instagram DMs (InstantDM). Even there, you do not let a model send money-language unattended. On-feed comments are worse: they are public and they are you.

Should it fake engagement?

No. Likes, follows, comment spam, hashtag stuffing to game a trend. Platform rules. Our skill’s automation guidelines. I will not help you wire it.

Should it duplicate the same caption and image across ten Instagram accounts?

No. That is a spam pattern. Networks notice. So do people who follow two of those accounts.

Should it run browser automation against Instagram?

No. Unofficial paths get accounts banned. Official publishing APIs only. If a ClawHub skill promises otherwise, read What is ClawHub? and then do not install it.

Should it hold every client’s posts:write on one key?

No. Scope per workspace. Prompt injection plus a god key is an agency-ending week.

A compact “never” list you can paste into SOUL.md:

## You never
- Call publish_now unless the human said "publish now" or "post immediately".
- Invent customer counts, revenue, or quotes.
- Repeat the same caption+image on multiple accounts of one platform.
- Like, follow, or comment-spam to juice a post.
- Read .env, openclaw.json, or hermes .env into a caption or a tool argument.
- Run cron that publishes.

Confirm before publish is not etiquette. It is how you still have an account in six months.

Who has already got this wrong?

On X in August 2026, operators posted that their agent “hallucinated bad today, posted incorrect information to all of our social media handles, MULTIPLE TIMES.” That is the default outcome of YOLO publishing, not a rare bug.

I am not going to name the accounts. The pattern is the lesson: one session, write access on every network, no draft, no human, a model that wanted to be helpful about a metric it did not fetch.

Reddit’s agency threads are more conservative than Twitter demos: client approves everything; no automatic posting. Listen to the people who get fired when a caption is wrong.

Other failure modes I have seen or had reported, without turning them into folklore:

• Timezone trap. scheduledAt without offset = workspace TZ, not UTC. A “9am LinkedIn” ships at 3am. The founder thinks the scheduler is broken. The payload was naive.
• Catch-up burst. VPS down at 9:00. Comes back at 14:02. Seven posts dump. Looks automated because it is. Policy: skip or notify.
• Drive links. Agent attaches a preview URL. Publisher cannot fetch it. Instagram fails. Agent already said “done.”
• HTTP 200 theater. Create succeeded; one network rejected media. No get_post_status. You find out from a follower, not from Telegram.
• ClawHub stealer. Skill with install-time curl. Keys leave the box. Then someone else has posts:write. Early 2026 was ugly here. ClawHub.
• Public OpenClaw Gateway. Port 18789 on the open internet. Bind loopback.
• Hermes loop rewarded YOLO. You said “just post it” once. It wrote a skill. Cron loaded the skill. What Hermes is.

None of these require a malicious model. They require a missing approval.

Moltbook, briefly: agents posting to a social network for agents, around the Moltbot rename. A warning about unattended posting as culture, not a growth channel. Rename timeline.

What does a safe weekly loop look like?

1. Monday cron: agent researches, writes five drafts, attaches media, saves draft: true, dumps a pack in Telegram.
2. You tap 1 / 2 / 3 or open the calendar. Activate or edit.
3. Scheduler fires at the times you approved.
4. Friday cron: get_analytics, write “do more of X” into MEMORY.md. Nothing publishes.

That is always-on as a calendar, not as a mouth.

Two clocks:

Clock	Owner	Example
Agent wake	Hermes cron / OpenClaw automations	Weekdays 08:00 Asia/Kolkata: draft
Network go-live	Scheduler scheduledAt	LinkedIn 08:30 ET, IG 11:00 local

Hermes:

hermes cron create "0 8 * * 1-5" "Isolated session. Read SOUL.md. Draft five posts for empty slots this week. draft true. Never publish_now. Deliver IDs to Telegram." --name "weekday-drafts" --deliver telegram

OpenClaw: openclaw automations create with an isolated session and announce-to-channel. Exact flags move; isolation should not. Yesterday’s rant must not leak into today’s caption.

Isolated session is the bit people skip. Shared context is how a customer complaint becomes a subtweet.

Freeze, practiced before you need it:

Freeze social. Do not create, schedule, or publish. Confirm the queue is untouched.

Same line in SOUL.md. Pause cron. Open the calendar by hand. Crisis is not the time to invent process.

If the VPS missed the window: skip. Do not burst.

A four-week ramp I actually recommend:

Week	Agent may	Agent may not
1	list_accounts, one draft/day, you edit every word	Cron, extra networks, live
2	Five drafts on Monday, you approve Tuesday	publish_now
3	Scheduled posts with offsets, after you eyeball the pack	Unattended live
4	Friday analytics into MEMORY.md	Comments, DMs-as-you, engagement bots

If week 1 drafts are off-voice, do not “fix it with cron.” Fix SOUL.md. Give three real posts you like, three you would never publish, and a banned-phrase list. Adjectives (“friendly, professional, bold”) produce LinkedIn sludge. SOUL.md.

Social by InstantDM calendar UI, captured 28 August 2026. Drafts live here, not in the model’s head. Approve in the same pipeline the agent writes to.

Does this replace Buffer, or replace a social media manager?

It replaces the swivel-chair between ChatGPT and Buffer. Buffer still only schedules what you already wrote. The agent writes; the scheduler still has to exist.

It does not replace you — or a hire — for:

• Saying no to a trend that is off-brand
• A crisis freeze
• A partnership post with legal language
• Reading the room in comments
• A founder voice that has to sound like a specific human
• Deciding that this week, silence is the strategy

If those are your whole job, you do not need this stack. If those are 20% of your job and caption-and-queue is 80%, this stack is the 80%.

Agency version, because I get asked: your client still approves. The agent drafts into a workspace scoped to that client. You send a pack. They tap. You do not “increase retainer efficiency” by turning publish_now on at midnight. The conservative Reddit threads are right. The Twitter demos are a product incident waiting for a logo.

Scheduler comparison is a different series on this site (Buffer, Hootsuite, and the rest). This page is not “switch to us because AI.” This page is: if you already want an agent in the loop, do not ask the agent to be the scheduler. Personal agent vs publisher.

Where we sit: eight platforms, hosted MCP, 16 tools, REST parity, from $19/month as I described in the MCP server guide. Not open source. If you need to self-host the token vault, keep the split on software you can own.

Which agents can do this, and does the choice matter?

Any MCP client: OpenClaw, Hermes Agent, Claude, ChatGPT, Codex, Cursor, Grok. The agent is interchangeable. The publisher is not.

Agent	Why people pick it for social	Why it still is not the publisher
OpenClaw	iMessage, ClawHub, one Gateway	Chat ≠ Graph
Hermes	Cron, memory, self-written skills	Same last mile
Claude / ChatGPT	No VPS, connector UI	You are the cron
Codex / Cursor	Draft while you code	Easy to ship from a terminal you stopped watching

OpenClaw vs Hermes at length: the 2026 comparison. Stars on 27 August 2026 do not post to Instagram.

If you run both, give one of them posts:write. The other can draft in a file. Mystery posts are how you learn you had two crons.

Skill installs, exact slugs:

openclaw skills install @sanjaykhanssk/social-by-idm
hermes skills install github:instant-dm/agent-mode/skills/social-by-idm

MCP URL for both: https://social-api.instantdm.com/mcp.

Walkthroughs: OpenClaw posting, Hermes posting, OpenClaw skill, Hermes skill, mcp add.

Claude connectors menu, captured 27 August 2026. Same hosted MCP server the Gateways use. If you can see the connector, you can also ship a wrong caption — start with list_accounts.

Does the model pick matter? For drafts, yes: voice, instruction-following, tool use. For not getting banned, no: the model does not implement Instagram’s rules. The publisher does. Pick a model you will actually read the output of.

Is automated engagement allowed?

No.

Fake likes, follows, comments, or trending manipulation violate platform rules. They also violate our skill. I am not going to hedge this with “it depends on volume.”

What people mean by “engagement,” and the answer:

Idea	Allowed in this stack?
Official publish via Graph / member APIs / Content Posting	Yes, through a scheduler
Drafts and scheduled posts you approved	Yes
Analytics readback	Yes
Model-written reply you send by hand	Yes
Model-written reply the agent sends unattended	No
Like/follow/comment bots	No
Mass duplicate across IG accounts	No
Unofficial mobile APIs / web scraping to post	No

If your growth plan requires a bot farm, you do not have a content problem. You have a ToS problem. I will not be in the log.

Community is the part of social that does not factory well. That is why the 80/20 split exists. Automate the queue. Hire or show up for the comments.

What stack do I actually recommend?

Layer	Pick
Chat + memory + cron	OpenClaw or Hermes, or Claude if you do not want a VPS
Publisher	Scheduler with official APIs + MCP (we are one: agents)
Policy	SOUL.md + SKILL.md
Human	Whoever owns the brand. Thirty minutes, twice a week.

Start with list_accounts, then drafts. If the drafts are good for a week, then you shorten the approval. You do not start from live.

Hosting: OpenClaw Gateway on loopback, port 18789, VPS if you want always-on, not a laptop you close. Hermes: hermes doctor clean, ~/.hermes/config.yaml, key in ~/.hermes/.env, /reload-mcp. Installers:

curl -fsSL https://openclaw.ai/install.sh | bash
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

Docs: docs.openclaw.ai, hermes-agent.nousresearch.com/docs.

Default write: draft: true. No publish_now from cron. scheduledAt without offset = workspace TZ, not UTC.

I recommend this stack to people who already write, already have professional accounts, and already feel the Sunday batch. I do not recommend it to people whose plan is “the agent will figure out content.” It will figure out something. You will have to explain it.

Product pages: /mcp, /agents, /docs.

How do drafts, scheduledAt, and timezone actually fail?

Three knobs. Most incidents are one of them.

draft: true — the post is in the calendar, not on the network. You can edit, delete, or activate. This is the default in our skill. If your homemade skill omits it, the model will infer from your tone. Hurried tone infers live.

publish_now / immediate — live. Human phrase only. Not a crontab. Not a heartbeat. Not “you have posted this style before so I continued.”

scheduledAt — a timestamp. Without an offset, it is workspace timezone, not UTC. That is the trap.

Worked examples:

# Means 09:00 in Mumbai, unambiguously
2026-09-16T09:00:00+05:30

# Means 09:00 in whatever the workspace TZ is
2026-09-16T09:00:00

# If workspace is UTC and you meant IST, this is 14:30 IST
2026-09-16T09:00:00Z

If you operate across regions, put offsets. If you have one workspace in one city, set the workspace TZ once, write it in SOUL.md (“workspace is Asia/Kolkata”), and still prefer offsets when the agent fills JSON. Models forget implied context. They remember ISO-8601 with a sign.

platformSchedules is how you say Instagram at 11:00 and LinkedIn at 08:00 for the same logical post. Useful. Still needs offsets or a known workspace TZ. Still should start life as a draft you saw.

After a real publish, get_post_status. HTTP 200 on create is not “all five networks live.” Instagram may have rejected the media. LinkedIn may be pending. The calendar knows. The model will lie cheerfully without the second call.

Media: public URL the publisher can GET, or the upload tools (create_upload_url / complete_upload / upload_media_from_url). Not a Google Drive preview. Not a localhost path on the VPS the scheduler cannot see.

What happens in a crisis?

You already wrote the freeze line. You send it. You pause cron. You open the calendar.

What “crisis” means here:

• A wrong fact went live
• A person is dead and your scheduled joke is still in the queue
• Legal emailed
• The product is down and your “we never go down” carousel is due at 11
• A prompt-injected session may have created posts you have not seen

Actions, in order:

1. Freeze message to the agent. Require a confirmation that it will not write.
2. Disable the weekday cron / OpenClaw automation. Do not trust the model to “just stop.”
3. Open the scheduler. Delete or pause everything you did not personally want yesterday.
4. If something live is wrong, delete via the publisher (delete_post / delete_platform_post) or native UI. Then tell the truth in a follow-up you wrote.
5. Rotate the API key if you suspect injection or a leaked chat log.
6. Only then do a postmortem on SOUL.md, the skill, and whether posts:write belonged on that session.

Do not ask the agent to “handle the crisis.” That is how you get a second wrong post with a sincere tone.

If you never practiced freeze, you will invent wording while angry. Invented wording is how you send a half-clear instruction and the cron still fires. Put the line in SOUL.md this week, not after.

How do you tell the factory is working after four weeks?

Not follower count. Follower count moves for reasons that have nothing to do with your cron.

Signs the factory works:

• You stopped doing Sunday caption batch in a Notes app.
• Drafts arrive with real post_… IDs and real account IDs.
• You reject or edit at least some of them. 100% accept is a sign you stopped reading.
• Instagram failures show up as publisher errors (needs media, carousel < 2), not as “the agent said it posted.”
• Friday MEMORY.md contains numbers from get_analytics, not adjectives.
• No post has gone live that you cannot find in the calendar first.
• Freeze was tested once and the queue stayed untouched.

Signs it does not:

• You are afraid to open Instagram in the morning.
• Telegram says “done” and the calendar is empty.
• The same caption landed on LinkedIn and X with different length rules ignored (platformContent unused).
• Three posts went out at 14:02 after an outage.
• A number in a caption cannot be traced to analytics or a source you provided.
• Hermes grew a homemade publish skill you did not pin against.
• Two runtimes both have posts:write.

A simple weekly scoreboard you can keep in MEMORY.md:

Question	Yes / No
Did cron only create drafts?
Did I open the calendar before anything went live?
Did any caption contain a number I cannot source?
Did any network fail, and did we call get_post_status?
Did I send freeze as a drill this month?

If you cannot tick those without lying, do not add a fifth network. The factory is still a demo.

Agencies: add “did the client see the pack.” If the answer is “we assumed they would,” you have unattended posting with extra steps.

What platform rules can the agent still not bypass?

The model does not get a special Instagram. Official APIs still win arguments.

Network	Rule the agent cannot charm away
Instagram	Professional account, media required for feed, carousels need ≥2 images, Graph — not a Telegram bot token
LinkedIn	Member (or org) scopes, token lifetime, deletes that can report success and lie — check status
TikTok	Content Posting API, media constraints, not a web scrape
X	App + tokens, length is real, duplicate spam patterns
Facebook Pages	Page token, not a personal profile shortcut
YouTube / Pinterest	Their upload rules, their OAuth

Our publisher rejects what the network will reject, on purpose. A text-only IG create_post should fail at our door, not at 11:00 in the fire time. When it fails, the agent should tell you. If the agent says success, you missed get_post_status.

Rate limits exist. A cron that retries failed IG uploads every minute looks like a bot. Back off. Skip. Tell the human.

None of this is new because you added OpenClaw. Graph did not get friendlier in 2026 because a Gateway has 387,774 stars. The stars are on github.com/openclaw/openclaw, not on Meta’s review form.

If a skill says it posts to IG without a professional account, it is unofficial. I will not document it. Ban risk is the product.

What should you try this week, and what should you not?

Try:

1. One agent, one workspace, one network.
2. Skill + MCP. Exact slugs. URL https://social-api.instantdm.com/mcp.
3. list_accounts.
4. One draft. You edit it. You leave it as draft.
5. SOUL.md with three good posts, three bans, never-publish-now.
6. A freeze message, once, so you know what the reply looks like.

Do not try:

• Five networks on day one
• Cron on day one
• publish_now to “see if it works”
• A ClawHub skill you have not read
• Browser automation
• Comment bots
• Running OpenClaw, Hermes, and Claude all with write keys
• Binding port 18789 to the world

If you want the longer wiring: How to let OpenClaw post, How to let Hermes post. If you want the architecture: Personal agent vs publisher. If you want the runtime pick: OpenClaw vs Hermes.

An agent can run the factory. You still run the brand. That split is the only version of “AI social media” I will help you ship.