Scheduled reader executed a Hermes update string it was only supposed to report

Chinese builders (@laogua_daily, @xiaoyaoshowmore) described a cron task whose job was to report new posts. It saw the text “Run hermes update” and ran it. Their point: reading and acting collapsed into one step. Engagement is low; the failure mode is not.

Credit@laogua_daily, @xiaoyaoshowmore

Cover art for Security: Scheduled reader executed a Hermes update string it was only supposed to report

Why it matters

Classic agent bug. Anything that scrapes the web or other agents needs a hard read-vs-act boundary, especially around update and shell strings.

From the source

Hermes Agent #hermes #prompt-injection #cron #security #tool-use

More Security

SecurityOct 22

Blackbox Security Plugin Enters Hermes Catalog

Agent Blackbox is now in the official Hermes plugin catalog. It checks tool calls against a threat graph (Origin Trail DKG). Audit mode logs; block mode can refuse risky calls.

Credit@umanitek

SecurityOct 17

NVIDIA App Agent Control Enabled by Default

The NVIDIA App 11.0.9 update adds a local MCP server that allows agents (Hermes, OpenClaw, etc.) to control games, settings, and ShadowPlay. Many users found the toggle already enabled after the auto-update.

Credit@MichaelGannotti

SecurityOct 11

Hermes Config Injection Path to Approval Bypass (CVE-2026-108593)

VulnCheck published a CVE on a third-party dashboard (9router) that allows authenticated users to inject arbitrary keys into Hermes config.yaml via a settings endpoint. Demonstrated path: set hooks_auto_accept and a shell command that then runs after LLM calls with no further approval. The underlying condition is “write access to Hermes config = ability to disable approval gates.”

Credit@ueo0j

Never miss a night

Every pick, delivered to your reader.

One feed for everything, or one per agent harness you run. Rebuilt every night, with full credit on every item.