Executive brief
NousResearch hermes-agent is an AI agent framework that uses persistent memory to maintain context across sessions. A vulnerability in its security scanner allows attackers to bypass prompt injection protections by using specific word combinations that the system's filters do not recognize. If exploited, an attacker can permanently alter the agent's behavior, potentially leading to unauthorized data access or the execution of malicious instructions across all future user interactions.
Technical details
A prompt injection vulnerability exists in NousResearch hermes-agent versions prior to 0.15.0 due to insufficient regex patterns in the _scan_memory_content function within tools/memory_tool.py and tools/mcp_tool.py. The scanner uses rigid regular expressions (e.g., r'ignore\s+(previous|all|above|prior)\s+instructions') that fail to account for intervening words or multi-word variations. An attacker can bypass these filters by inserting words between 'ignore' and the target keywords (e.g., 'ignore all prior instructions'). Because the agent persists these inputs to MEMORY.md and reloads them into the system prompt at the start of every session, a successful bypass results in permanent 'jailbreaking' or behavioral alteration of the agent. This can be triggered remotely via any interface the agent monitors, such as Discord, Slack, or an API server.
Affected products
- NousResearch hermes-agent < 0.15.0
Timeline
- 2026-05-07: other: Vulnerability details and PoC shared via GitHub Gist
- 2026-06-01: disclosed: CVE-2026-10223 published
- 2026-07-28: patched: GitHub Advisory reviewed and patch confirmed in version 0.15.0