Executive brief
Hermes Agent is an AI agent that executes file operations based on user-supplied instructions. A vulnerability in versions prior to 0.17.0 allows attackers to overwrite the credential store (auth.json) through crafted messages, bypassing path-protection guards. An attacker who can influence the messages processed by the agent can steal or tamper with credentials used for authentication.
Technical details
Hermes Agent 0.16.0 and prior versions contain an improper path restriction vulnerability in the file-write tooling that enables unauthorized modification of the credential store (auth.json). The vulnerability arises from incomplete path-based protection guards that excluded auth.json from sensitive-path checks while other credential files were protected. An attacker who can influence ingested message content can craft malicious instructions to the agent's file-write functions (cp, mv, install, tee, or redirection) to overwrite the credential store without triggering approval gates. The agent's approval system used DANGEROUS_PATTERNS regex to block writes to sensitive targets, but the patterns were asymmetrically applied—redirection and tee operations were gated, but equivalent copy/move/install operations were not. Patches in 0.17.0 (commits 2b67e96 and da28d5d) extend DANGEROUS_PATTERNS to cover cp/mv/install operations against the full set of sensitive write targets including credential files.
Affected products
- Nous Research Hermes Agent 0.16.0 prior to 0.17.0
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Fixed in version 0.17.0