Directory / Hermes Agent

Hermes Agent

Personal agent (open source) · Nous Research · 6/7 verified · Listed on agentsafetyscore 2026-10-22 · Last checked 2026-10-22

Pattern-based approval for dangerous shell commands, a hardline blocklist that holds even in YOLO mode, and per-platform toolsets. Commands run on your host unless you pick a container backend.

Overall: C (1.67 avg, 6/7 controls verified)

Lock this down first

Use the docker backend for any gateway, keep approvals.mode on smart or manual, never set GATEWAY_ALLOW_ALL_USERS, and update to v0.22.4 or later if you use webhook routes.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	Toolsets decide which tools each platform, session or route gets, and approvals.deny blocks matching shell commands even in YOLO mode. Per-tool allow, ask or deny isn’t documented. 2026-10-21: CVE-2026-114463 (CERT/CC): a webhook route name with a colon could get a higher-privileged route’s toolsets, such as terminal and file access. The fix (PR #115285) was merged Sep 18; NVD links the v0.22.2 release. Update to the latest release (v0.22.4).
Human approval gates	2/3	Dangerous shell commands need approval. The default smart mode lets an LLM auto-approve low-risk ones, prompts time out to deny, and cron, one-shot and webhook sessions deny by default. Other tools aren’t gated, and container backends skip the checks.
Sandboxing	2/3	Local backend by default, with no isolation. Docker, Singularity, Modal, Daytona and Vercel backends run commands in a container with dropped capabilities and no-new-privileges.
Secrets handling	2/3	Sensitive env vars are stripped from terminal, execute_code and MCP subprocesses, credential files are write-blocked, and MCP error text is redacted. API keys sit in a plain .env file.
Audit logs	1/3	Logs under ~/.hermes/logs and a local session database of executed commands. No signed or central audit log.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	1/3	A website blocklist and SSRF protection cover the web and browser tools only. Terminal commands aren’t covered, and there’s no allowlist.

Unverified: Kill switch / interrupt. That means we could not confirm it in public docs, not that it is missing.

Public reports

Independent reporting, not used for scoring.

2026-10-21 · NVD: CVE-2026-114463: webhook route toolset authorization bypass (web-only route could get terminal and file tools)

Sources

Vendor? Request a correction. We review every correction request. How corrections work.