Is CVE-2026-10221 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10221 being exploited in the wild.

How severe is CVE-2026-10221?

High severity, with a CVSS score of 7.3, published 1 June 2026.

Which products and versions are affected?

NousResearch Hermes Agent <= 0.19.0; hermes-agent (PyPI) ECOSYSTEM:introduced=0,last_affected=0.19.0.

Is there a fix for CVE-2026-10221?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10221 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10221?

Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10221: NousResearch hermes-agent prompt injection in context compression

Q: Is there a fix for CVE-2026-10221?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-10221 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-10221?

Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10221 · Severity: high · CVSS 7.3 · Published 2026-06-01

A vulnerability exists in hermes-agent, an AI agent framework, that allows attackers to hijack the agent's behavior. By planting malicious text within a "todo" list item, an attacker can force the AI to ignore its original safety instructions and perform unauthorized actions, such as stealing sensitive data or abusing connected tools, once the agent's memory reaches a certain limit. This occurs because the system fails to distinguish between administrative task lists and direct user commands during its memory cleanup process.

Technologies: NousResearch Hermes Agent, hermes-agent (PyPI). Vendors: NousResearch, PyPI.

Quick answers

Is CVE-2026-10221 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10221 being exploited in the wild.
How severe is CVE-2026-10221?: High severity, with a CVSS score of 7.3, published 1 June 2026.
Which products and versions are affected?: NousResearch Hermes Agent <= 0.19.0; hermes-agent (PyPI) ECOSYSTEM:introduced=0,last_affected=0.19.0.
Is there a fix for CVE-2026-10221?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10221 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10221?: Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A prompt injection vulnerability exists in the `_compress_context` method of `run_agent.py` in hermes-agent versions up to 0.19.0. When the agent's context window overflows, the system triggers a compression routine that preserves active tasks by calling `TodoStore.format_for_injection()`. This function concatenates raw, unsanitized todo item content into a string that is then appended to the message history as a `{"role": "user"}` message. Because instruction-tuned LLMs prioritize the most recent user message, an attacker can plant a payload in a todo item (either directly or indirectly via malicious documents the agent reads) that overrides system prompts, leading to unauthorized tool execution or data exfiltration. A patch was committed (2ca38e5) but advisories indicate versions up to 0.19.0 may remain affected.

Affected products

NousResearch hermes-agent <= 0.19.0

Identifiers

CVE-2026-10221
GHSA-xq8w-9jvx-gm3v
PYSEC-2026-3577

Timeline

2026-05-07: disclosed: Initial PoC and report created by researcher YLChen-007
2026-06-01: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.