)
Last updated: October 26, 2026
Is Hermes Agent safe to run? Hermes Agent, the open-source agent from Nous Research, can be run safely, but only with deliberate setup: explicit allowlists, a container or remote terminal backend, manual command approval and current versions. The project's own security policy says the only security boundary against an adversarial model is the operating system. The GitLab Advisory Database lists ten advisories for the package as of October 26, 2026.
This guide covers what the agent does, where its attack surface sits, the CVEs checked against primary records, the OWASP 2026 mapping and a safe-setup checklist from the project's documentation. Anything unverified is labeled as such.
TL;DR: Key Takeaways
- The GitLab Advisory Database lists 10 advisories for the hermes-agent package, and other records add more (GitLab Advisory Database, 2026).
- The most severe is CVE-2026-82021, scored 9.0 (critical) on CVSS v4.0: a supply chain flaw in the bundled MCP catalog, fixed in 0.19.0 and 2026.7.20 (CVE record, published August 28, 2026).
- Hermes Agent offers 7 terminal backends, and the Docker, Modal, Daytona and Vercel Sandbox backends skip command approval because the container is treated as the boundary (Hermes Agent docs, 2026).
- The project's security policy offers 2 OS-level isolation options and treats in-process controls such as the approval gate as heuristics. It places prompt injection alone out of scope (SECURITY.md, 2026).
- The advisories map to 4 of the 10 entries in the OWASP LLM Top 10 2026 (LLM01 to LLM04) (OWASP GenAI Security Project, 2026).
- The project's hardening guidance runs to 11 steps, led by explicit allowlists and a container or remote backend (Hermes Agent docs, 2026).
Hermes Agent security at a glance
| Surface | What Hermes Agent does there | Documented issue class | Main control |
|---|---|---|---|
| Terminal and code execution | Runs shell commands and execute_code on one of 7 backends | Environment handling (CVE-2026-9368) | Container or remote backend, manual approvals |
| Context, memory and skills | Reads project files, stores memory, writes its own skills | Injection through prompt, memory and skill scanners (CVE-2026-9366, 9353, 10223) | Skills Guard, skill review, isolation |
| Messaging gateway | Takes instructions from chat channels | Caller authorization | Allowlists, DM pairing |
| HTTP and WebSocket endpoints | Serves a dashboard, an API and webhooks | Missing authentication, DNS rebinding (CVE-2026-7112, 7113, 53869) | Keep off the public internet |
| Files on disk | Stores sessions, webhook subscriptions and secrets | World-readable permissions (CVE-2026-53870) | Upgrade, restrict file modes |
| Supply chain | Installs an MCP catalog, skills, plugins and itself | Mutable branch reference (CVE-2026-82021) | Review, pin, update |
What Is Hermes Agent and What Does It Do?
Hermes Agent is an open-source, MIT-licensed Python agent from Nous Research. It runs on your own machine or server, remembers past sessions, writes reusable skills and takes instructions from chat apps. It can also run shell commands and schedule jobs, so its security posture matters more than a chat assistant's.
The code lives in the NousResearch/hermes-agent repository, which showed about 252,000 GitHub stars when checked on October 26, 2026. This article is about that agent. It is unrelated to the Hermes family of language models that Nous Research also publishes.
Core capabilities
According to the project's README (2026), Hermes Agent combines pieces that most agent frameworks sell separately. Each one creates its own risk.
| Capability | What the README describes | Why it matters for security |
|---|---|---|
| Agent-curated memory | Memory the agent maintains, with full-text search across past sessions | Stored text is replayed into later prompts, so one poisoned entry persists |
| Self-created skills | Skills the agent writes, compatible with the agentskills.io format | Skills run with full agent privileges once installed |
| Scheduler | A built-in cron scheduler | Jobs run unattended, with no person to approve a command |
| Terminal backends | Local, Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox | The backend decides how much a bad command can damage |
| MCP and subagents | MCP server integration and delegated subagents | Each tool server and subagent extends the trust boundary |
Installation is a one-line shell command (a PowerShell equivalent exists for Windows), followed by hermes setup and hermes doctor. That convenience is common for open-source tools, but it means you trust the script and the repository at install time.
The security policy describes Hermes Agent as a single-tenant personal agent: one owner, one trust domain, and an operating system that acts as the real boundary. Teams that serve several users, or point it at untrusted content, are outside that model.
)
Attack Surface: Where a Self-Hosted Agent Can Be Abused
The attack surface of an agent like Hermes is wider than a chat app's because one process combines shell access, persistent memory, installable skills, messaging channels and network endpoints. Each is a separate entry point, and several are trusted by default, so your exposure depends largely on how you configure it.
Terminal and code execution
Hermes puts a command approval system in front of risky commands. According to the Hermes Agent documentation (2026), the default smart mode asks an auxiliary model to rate each command. Manual mode asks you every time. Off mode disables the checks, the same as the --yolo flag. Cron jobs, single-query runs and webhook sessions deny dangerous commands by default, because nobody is present to answer. A hardline blocklist refuses catastrophic commands such as root filesystem wipes under every setting.
The limits matter more than the features. The security policy calls the approval gate, output redaction, pattern scanners and skill scanning heuristics, not containment. It also states that code execution, MCP, plugins, hooks and skills still run in the host Python process when only the terminal is sandboxed. Terminal isolation therefore covers shell and file operations, not the whole agent.
Context, memory and skills
Hermes reads project context files such as AGENTS.md, keeps searchable memory and installs skills. Each is text that the model treats as instructions or trusted context. The documentation says context files are scanned for prompt injection and blocked on a match, and that Skills Guard scans skills for suspicious environment access before install.
Those scanners have had their own flaws. CVE-2026-9366 sits in the prompt builder's context scan, CVE-2026-9353 in Skills Guard and CVE-2026-10223 in the memory scanner. Persistence is the multiplier: a poisoned memory entry or skill outlives the session that created it.
Messaging gateways and credentials
A gateway turns every connected chat account into a control channel. The documentation describes a default-deny model: with no allowlists configured, all users are denied, and unknown direct-message senders can receive a short-lived pairing code that the owner approves from the command line.
Credentials are the other half. API keys and platform tokens live in the agent's environment files. Sensitive variables are stripped from execute_code and terminal child processes by default, and credential files are mounted read-only into containers. Two CVEs show where that handling slipped: CVE-2026-9368 on environment handling in code execution, and CVE-2026-53870 on files left readable by other local users.
Network endpoints
Hermes includes a web dashboard, an API server and webhook receivers. CVE-2026-7112 and CVE-2026-7113 concern missing authentication on the API server and webhooks. CVE-2026-53869 is a DNS rebinding flaw. It let remote attackers bypass Host and Origin checks on WebSocket endpoints, including a terminal channel, because the HTTP middleware does not run on WebSocket upgrades.
The project's guidance is blunt: do not expose the gateway or API to the public internet without a VPN, Tailscale or a firewall.
Supply chain and installer
Skills and plugins run with full agent privileges, and the policy tells operators to review them, including the Python code and scripts, not only the skill description file. CVE-2026-82021 shows the other side: the bundled MCP catalog pointed at a third-party repository by a mutable branch instead of a pinned commit. For background on why tool servers deserve this scrutiny, see our guide to what an MCP server is.
Hermes Agent CVEs and Advisories: What Is Documented
As of October 26, 2026, the GitLab Advisory Database lists ten advisories for the hermes-agent package, and other records add more. The table covers twelve CVEs checked against advisory records. Nine list a fixed version between 0.11.0 and 0.19.0, and three do not state one.
| CVE | Issue | Affected | Fixed | Published |
|---|---|---|---|---|
| CVE-2026-82021 | MCP catalog supply chain flaw via a mutable branch reference (CWE-494) | 0.18.2 up to 0.19.0 and 2026.7.7.2 up to 2026.7.20 | 0.19.0 and 2026.7.20 | Aug 28, 2026 |
| CVE-2026-53869 | DNS rebinding on WebSocket endpoints bypasses Host and Origin validation | Before 0.16.0 | 0.16.0 | Jun 17, 2026 |
| CVE-2026-53870 | Response store and webhook subscription files created with mode 0o644, exposing conversation history and HMAC secrets | Before 0.16.0 | 0.16.0 | Jun 17, 2026 |
| CVE-2026-10222 | Injection in environment line sanitizing (_sanitize_env_lines) | Before 0.18.0 | 0.18.0 | Jun 1, 2026 |
| CVE-2026-10223 | Injection in memory content scanning (_scan_memory_content) | Before 0.15.0 | 0.15.0 | Jun 1, 2026 |
| CVE-2026-9353 | Injection in Skills Guard threat patterns | Before 0.15.0 | 0.15.0 | May 26, 2026 |
| CVE-2026-9366 | Injection in context scanning (_scan_context_content) | Before 0.15.0 | 0.15.0 | May 26, 2026 |
| CVE-2026-9369 | Incorrect comparison in dashboard plugin discovery (HERMES_ENABLE_PROJECT_PLUGINS) | Before 0.15.0 | 0.15.0 | May 26, 2026 |
| CVE-2026-9368 | Environment handling in execute_code (CWE-269, CWE-526) | Before 0.11.0 | 0.11.0 | May 2026 |
| CVE-2026-7112 | Authentication check flaw in the API server | Listed as 0.8.0, full range not stated | Not stated | Apr 27, 2026 |
| CVE-2026-7113 | Webhook endpoint with missing authentication | Listed as 0.8.0, full range not stated | Not stated | Apr 27, 2026 |
| CVE-2026-14628 | Path traversal in gateway media extraction (extract_media) | Up to 2026.5.16 | Not stated | Jul 4, 2026 |
How to read the table
The project uses two version schemes, semantic versions such as 0.16.0 and date-based tags such as 2026.7.20, and advisories mix them. Where a record states both, the table shows both. The dates are publication dates in the advisory databases, not discovery dates; for CVE-2026-82021 the CVE record gives July 14, 2026 as the date the issue became public.
Severity scores for the same CVE differ between databases because each scorer applies its own vector. The table therefore leaves scores out, except for the critical one in the CVE record. Two further entries, CVE-2026-10221 and CVE-2026-10224, appear in the GitLab database with conflicting or missing version data, so this article does not rely on them.
According to the CVE record for CVE-2026-82021 (2026), a compromised third-party repository could reach every host that installed the affected catalog entry, with no action by the operator. The record also lists CVSS v3.1 8.3 and names VulnCheck as the CNA.
What the CVEs have in common
Three patterns recur: scanners for context, memory and skills were bypassable, network-facing pieces lacked strong authentication in early versions, and defaults on disk and in the catalog trusted too much.
The practical rule is to run the newest release: the highest fixed version in the table is 0.19.0, or 2026.7.20 on the date-based scheme. For the three entries with no stated fix, check the release notes for your version rather than assuming you are covered.
OWASP Mapping: LLM Top 10 2026 and the Agentic Top 10
Hermes risks map onto the OWASP Top 10 for LLM Applications 2026 mainly through LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency and LLM04 Supply Chain. On the agentic list they land on goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution and memory poisoning.
According to the OWASP GenAI Security Project (2026), the Agentic Top 10 runs from ASI01 Agent Goal Hijack to ASI10 Rogue Agents.
| Hermes risk | Evidence | OWASP LLM Top 10 2026 | OWASP Agentic Top 10 |
|---|---|---|---|
| Hostile text in context files, memory or skills steers the agent | CVE-2026-9366, 9353, 10223 | LLM01 Prompt Injection | ASI01 Agent Goal Hijack, ASI06 Memory & Context Poisoning |
| Environment and files expose secrets or history | CVE-2026-9368, 53870 | LLM02 Sensitive Information Disclosure | ASI03 Identity & Privilege Abuse |
| Shell and code execution with broad rights | Approval modes, --yolo, host-process execution | LLM03 Excessive Agency | ASI02 Tool Misuse & Exploitation, ASI05 Unexpected Code Execution |
| Unauthenticated or rebindable endpoints reach the terminal | CVE-2026-7112, 7113, 53869 | LLM03 Excessive Agency | ASI03 Identity & Privilege Abuse |
| Catalog, skills, plugins and installer | CVE-2026-82021 | LLM04 Supply Chain | ASI04 Agentic Supply Chain Vulnerabilities |
| Approval prompts answered by habit | Smart and manual modes depend on a person | LLM03 Excessive Agency | ASI09 Human-Agent Trust Exploitation |
Two entries are left out on purpose. LLM06 Unbounded Consumption would fit CVE-2026-10224, but that record's version data conflicts. LLM08 Hidden Context Exposure has no verified Hermes advisory behind it; the history exposed by CVE-2026-53870 maps to LLM02.
The mapping also shows a gap between OWASP and the project. OWASP ranks prompt injection first. The Hermes security policy treats it as out of scope unless it breaks the stated trust model. Both positions are defensible for a personal tool, and they are why a team deployment needs controls that sit outside the agent.
Safe Setup Checklist From the Project's Own Docs
A safe Hermes setup matches isolation to the trustworthiness of the content the agent reads. For untrusted input, run the whole process in a sandbox. For everything else, use explicit allowlists, a container or remote terminal backend, manual or smart approvals, and a patched release, and keep the gateway off the public internet.
According to the Hermes Agent security documentation (2026), the recommended hardening runs to 11 steps. The work-machine guide adds a shorter sequence, and the security policy adds deployment rules. The table merges them and marks the one item that is our addition. In the source column, Docs is the security page, Guide is the work-machine guide and Policy is SECURITY.md.
| Step | Setting or action | Why | Source |
|---|---|---|---|
| 1 | Set explicit allowlists, never allow-all in production | With no allowlist, all users are denied by default | Docs |
| 2 | Use a container or remote backend (docker or ssh) | Keeps commands off the host | Docs, guide |
| 3 | Set approvals.mode to manual or smart, avoid YOLO and off | Keeps a person in the loop | Docs, guide |
| 4 | Add approvals.deny rules | Blocks listed commands even under YOLO | Guide |
| 5 | Set HERMES_WRITE_SAFE_ROOT | Confines write_file and patch to chosen folders | Guide |
| 6 | Leave docker_forward_env empty | Keeps host secrets out of the container | Guide |
| 7 | Prefer DM pairing to hardcoded user IDs | Short-lived, rate-limited approval codes | Docs |
| 8 | Run the gateway as a non-root user | Limits damage from a compromise | Docs, policy |
| 9 | Keep .env at chmod 600 and out of version control | Protects keys and tokens | Docs |
| 10 | Restrict terminal.cwd away from sensitive directories | Reduces reachable files | Docs |
| 11 | Audit command_allowlist, ~/.hermes/hooks/ and logs | Hooks run in-process with no consent step | Docs |
| 12 | Keep Hermes updated, and consider security.allow_lazy_installs false | Fixes ship in releases; limits runtime installs | Docs |
| 13 | Check the release notes against the CVE table above | Our addition, so versions and fixes match | Ours |
Two more points come from the security policy. Keep credentials in a restricted operator file, and review third-party skills, including their Python code, before installing them.
Turn on checkpoints as well: snapshots before destructive operations let you revert with /rollback, and /rollback diff <N> previews the changes first. One caution from the work-machine guide applies to the whole checklist. These controls guard against an agent that is wrong, not one that is deliberately adversarial, so use an isolated backend for real containment.
Security and Governance: What a Runtime Layer Adds
A runtime layer adds what a personal agent does not ship with: central identity, per-tool policy, inspection of prompts and tool calls, and a tamper-resistant record of what the agent did. These controls run outside the agent's own process, so a bypassed in-process scanner does not remove them.
The risks line up with the OWASP lists above. Prompt injection (LLM01) is how hostile text reaches memory, skills or the terminal. Sensitive information disclosure (LLM02) covers keys and history. Excessive agency (LLM03) turns a successful injection into a command. The Hermes policy is explicit that its approval gate and scanners are heuristics. That is a fair position for a single-tenant tool, and an enterprise should read it as a design requirement: the missing controls have to come from somewhere else.
Four controls matter most for an organization that allows employees to run self-hosted agents like this one:
- Identity and access. Know which agents exist, who owns them and which credentials they hold. The authorization patterns in our guide to MCP authentication apply directly to tool servers behind a Hermes deployment.
- Policy at the tool call. Decide per tool and per argument what an agent may do, instead of trusting a model to refuse.
- Inspection and logging. Record prompts, tool calls and results where the agent cannot rewrite them.
- Testing before and after rollout. Probe the agent with injection and tool-misuse attacks, and repeat after each upgrade.
NeuralTrust is a Barcelona-based AI agent security company, and its Runtime Security Mesh is built for this layer. Agent Gateway (TrustGate) is designed to sit between agents and the models and MCP servers they call, so policy and logging do not depend on the agent's process. Agent Runtime Security (TrustGuard) inspects agent behavior at runtime. Agent Posture Management (TrustLens) helps inventory agents and their permissions, and AI Red Teaming (TrustTest) tests them against attacks such as prompt injection. For the human side of approvals, see our guide to human-in-the-loop AI agents.
Which Setup Should You Choose?
Choose by who the agent serves and what it reads. A personal experiment can accept more risk than a shared gateway. An agent that reads email, web pages or chat messages should always run in a container or a wrapped process.
| Scenario | Minimum setup | Avoid |
|---|---|---|
| Local experiment, no messaging, trusted files only | Smart or manual approvals, current release, HERMES_WRITE_SAFE_ROOT set | YOLO mode, public endpoints |
| Work machine | Manual approvals, approvals.deny rules, docker or ssh backend, empty docker_forward_env, checkpoints | Local backend, forwarded host secrets |
| Always-on gateway with chat channels | Container, allowlists or DM pairing, non-root user, VPN or firewall, restricted credential file | Allow-all, public API, shared bot tokens |
| Reads untrusted content (web, email, multi-user channels, untrusted MCP) | Whole-process wrapping in Docker or Compose, or NVIDIA OpenShell | Terminal-only isolation |
| Shared or enterprise deployment | Whole-process isolation plus external gateway, identity, logging and red teaming | Treating the single-tenant model as multi-user |
Conclusion
Hermes Agent is a capable self-hosted agent whose maintainers are open about its limits: in-process controls are heuristics, and the operating system is the boundary. The verified record shows fixes shipping across 0.11.0 to 0.19.0, so a current release inside a container, with allowlists and manual approvals, is a defensible baseline. Teams should add controls outside the agent before they scale it.
Secure Self-Hosted Agents in Production with NeuralTrust
Put policy, inspection and audit between your agents and the tools they can reach.
)
Related Reading
- Claude Code Security: Enterprise Risks and Controls: the same questions for another agent that runs commands.
- MCP Authentication: OAuth 2.1 Done Right for AI Agents: how to authorize the tool servers your agent calls.
- Human-in-the-Loop AI Agents: Oversight That Scales: what approval prompts can and cannot do.
FAQs about Hermes Agent Security
1. Is Hermes Agent safe to use?
It can be, with the right setup. The project documents command approval, default-deny user access and container isolation, and it has shipped fixes for most of its published CVEs. Its security policy still says the operating system is the only boundary against a hostile model. Use a container, allowlists, manual approvals and the latest release.
2. What CVEs affect Hermes Agent?
Twelve CVEs are covered above, from CVE-2026-9368 (before 0.11.0) to CVE-2026-82021, the critical MCP catalog supply chain flaw fixed in 0.19.0 and 2026.7.20. Nine list a fixed version. Three, CVE-2026-7112, CVE-2026-7113 and CVE-2026-14628, do not state one, so check the release notes for your version.
3. Does Hermes Agent run commands on my computer?
Yes, if you choose the local terminal backend. Hermes can run shell commands through seven backends, including Docker, SSH and Modal. On the local backend the commands run as your user, behind an approval gate that the project calls a heuristic. A container or remote backend keeps commands off the host.
4. How do I secure the Hermes Agent messaging gateway?
Set explicit allowlists or use DM pairing, and never enable allow-all in production. With no allowlist, the default is to deny all users. Run the gateway as a non-root user and keep tokens in a restricted credential file. Do not expose the gateway or API to the public internet without a VPN or firewall.
5. Should I run Hermes Agent in Docker?
For most uses, yes. The documentation recommends a container or remote backend over the host, and Docker containers drop nearly all Linux capabilities and cap resources. Note that terminal-only isolation leaves MCP, plugins, hooks and skills in the host process. When the agent reads untrusted content, wrap the whole process instead.
6. Can prompt injection compromise Hermes Agent?
Prompt injection can steer the agent through context files, memory, skills or web content, and several CVEs concern the scanners meant to catch it. The project places injection alone out of scope unless it breaks the trust model. Limit damage by isolating execution, requiring approvals and restricting credentials.
7. How do I track Hermes Agent security advisories?
Watch the repository's security advisories and release notes, and check the GitLab and GitHub advisory databases for the hermes-agent package. Record the version you run and compare it with the fixed versions in the CVE table after each release. Report any issue you find privately, not in a public issue.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- NousResearch/hermes-agent README, GitHub, accessed October 26, 2026
- Hermes Agent security policy (SECURITY.md), GitHub, accessed October 26, 2026
- Hermes Agent docs: Security, accessed October 26, 2026
- Hermes Agent docs: Secure Hermes on a work machine, accessed October 26, 2026
- CVE record CVE-2026-82021, CVE Program, published August 28, 2026
- GitLab Advisory Database: hermes-agent (PyPI), accessed October 26, 2026
- GitHub Advisory Database: hermes-agent, accessed October 26, 2026
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project, GitHub, accessed October 26, 2026
- GenAI and Agentic AI Exploit Roundup Q3 2026, OWASP GenAI Security Project, October 8, 2026
)
)
)
)