Executive brief
NousResearch hermes-agent is an AI-powered agent that automatically loads project context files to guide its behavior. A vulnerability in how it scans these files allows an attacker to bypass security filters by using specific phrasing in files like AGENTS.md or .cursorrules. If a user runs the agent in a directory containing a malicious file, the attacker can take full control of the AI's instructions, potentially forcing it to execute unauthorized terminal commands, modify files, or steal data without any user interaction.
Technical details
A prompt injection vulnerability exists in the `_scan_context_content` function within `agent/prompt_builder.py`. The vulnerability is caused by an incomplete regular expression in the `_CONTEXT_THREAT_PATTERNS` list, specifically the pattern `ignore\s+(previous|all|above|prior)\s+instructions`. This regex fails to account for multi-word fillers (e.g., "ignore all prior instructions"), allowing malicious payloads to bypass the scanner. Because the agent automatically loads files such as `AGENTS.md`, `.cursorrules`, and `CLAUDE.md` from the current working directory, an attacker can achieve a zero-click full prompt override. This can be leveraged to force the LLM to use available tools like `terminal`, `write_file`, or `delegate_task`. The issue was addressed in version 0.15.0 by hardening the regex patterns.
Affected products
- NousResearch hermes-agent < 0.15.0
Timeline
- 2026-04-24: disclosed: Initial discovery and Gist publication
- 2026-05-24: advisory: NVD/VulDB disclosure
- 2026-05-26: advisory: GitHub Advisory published
- 2026-06-30: patched: GitHub Advisory reviewed and patch confirmed in 0.15.0