Executive brief
NousResearch hermes-agent, a tool for managing AI agent skills and plugins, contains a security flaw in how it screens for malicious instructions. The system uses a basic text-matching filter that can be easily bypassed by slightly altering the wording of a command. If an attacker provides a malicious skill or plugin, they can override the AI's safety instructions, potentially gaining control over the agent's behavior or accessing sensitive information.
Technical details
A prompt injection vulnerability exists in the `_serve_plugin_skill` and `skill_view` functions within `tools/skills_tool.py`. The implementation relies on a static list of strings (`_INJECTION_PATTERNS`) and simple substring matching using Python's `in` operator to detect malicious content. Attackers can bypass this filter by using synonyms, inserting extra words, or adding whitespace (e.g., "ignore ALL prior instructions" instead of "ignore previous instructions"). While a more robust regex-based filter exists in `tools/skills_guard.py`, it is not utilized in the affected component. Successful exploitation allows an attacker-controlled skill to inject instructions directly into the LLM context, potentially leading to unauthorized data access or full agent takeover.
Affected products
- NousResearch hermes-agent up to 2026.4.30
Timeline
- 2026-05-07: disclosed: Initial vulnerability report and PoC published on GitHub Gist.
- 2026-06-01: advisory: CVE-2026-10220 published.