Is CVE-2026-10223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10223 being exploited in the wild.

How severe is CVE-2026-10223?

Medium severity, with a CVSS score of 6.3, published 1 June 2026.

Which products and versions are affected?

NousResearch Hermes Agent <= 2026.4.30; hermes-agent (PyPI) ECOSYSTEM:introduced=0,fixed=0.15.0.

Is there a fix for CVE-2026-10223?

Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10223?

Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10223: NousResearch hermes-agent prompt injection bypass in memory_tool.py

Q: Is there a fix for CVE-2026-10223?

Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-10223 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-10223?

Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10223 · Severity: medium · CVSS 6.3 · Published 2026-06-01

NousResearch hermes-agent is an AI agent framework that uses persistent memory to maintain context across sessions. A vulnerability in its security scanner allows attackers to bypass prompt injection protections by using specific word combinations that the system's filters do not recognize. If exploited, an attacker can permanently alter the agent's behavior, potentially leading to unauthorized data access or the execution of malicious instructions across all future user interactions.

Technologies: NousResearch Hermes Agent, hermes-agent (PyPI). Vendors: NousResearch, PyPI.

Quick answers

Is CVE-2026-10223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10223 being exploited in the wild.
How severe is CVE-2026-10223?: Medium severity, with a CVSS score of 6.3, published 1 June 2026.
Which products and versions are affected?: NousResearch Hermes Agent <= 2026.4.30; hermes-agent (PyPI) ECOSYSTEM:introduced=0,fixed=0.15.0.
Is there a fix for CVE-2026-10223?: Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10223?: Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hermes-agent (PyPI): upgrade to 0.15.0 or later
```
pip install "hermes-agent>=0.15.0"
```

Technical details

A prompt injection vulnerability exists in NousResearch hermes-agent versions prior to 0.15.0 due to insufficient regex patterns in the _scan_memory_content function within tools/memory_tool.py and tools/mcp_tool.py. The scanner uses rigid regular expressions (e.g., r'ignore\s+(previous|all|above|prior)\s+instructions') that fail to account for intervening words or multi-word variations. An attacker can bypass these filters by inserting words between 'ignore' and the target keywords (e.g., 'ignore all prior instructions'). Because the agent persists these inputs to MEMORY.md and reloads them into the system prompt at the start of every session, a successful bypass results in permanent 'jailbreaking' or behavioral alteration of the agent. This can be triggered remotely via any interface the agent monitors, such as Discord, Slack, or an API server.

Affected products

NousResearch hermes-agent < 0.15.0

Identifiers

CVE-2026-10223
GHSA-33qv-c5qm-799v
PYSEC-2026-3575

Timeline

2026-05-07: other: Vulnerability details and PoC shared via GitHub Gist
2026-06-01: disclosed: CVE-2026-10223 published
2026-07-28: patched: GitHub Advisory reviewed and patch confirmed in version 0.15.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.