Executive brief
NousResearch hermes-agent is an AI-driven agent framework that integrates with communication platforms like Slack and Mattermost. A vulnerability in its messaging adapters allows attackers to bypass security filters and force the agent to send mass notifications (such as @everyone or @all) to entire corporate workspaces. This can be used to disrupt business operations, spam thousands of employees simultaneously, and degrade the reputation of the automated agent.
Technical details
A vulnerability exists in the Slack and Mattermost adapters of NousResearch hermes-agent due to improper neutralization of special elements in output (CWE-116). In the Slack adapter's 'format_message' function, a regular expression intended to protect valid links inadvertently shields mass-mention tags like '<!everyone>', allowing them to bypass sanitization. In the Mattermost adapter, the 'send' method fails to set the 'disable_mentions' property to true in the API payload, allowing '@all' or '@channel' tags generated by the LLM to trigger push notifications. An attacker can exploit this via prompt injection to coerce the agent into sending workspace-wide pings. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- NousResearch hermes-agent up to 2026.4.16
Timeline
- 2026-04-24: disclosed: Initial researcher report created
- 2026-05-24: advisory: Public disclosure via VulDB and NVD