Hermes Agent Security
Hermes Agent is a self-hosted AI agent from Nous Research. Unlike a chatbot, it can run terminal commands, edit files, connect to MCP servers and take instructions from people over messaging apps. That reach is what makes it useful. It is also why a careless setup can hand someone else your machine, your files or your API keys.
The good news: Hermes ships with sensible defaults, and most of the real risk comes from how it is configured and where it runs. Below are the main Hermes Agent security risks, a setup checklist, and a free scan that shows what your Hermes host exposes to the internet.
Is Hermes Agent safe to use?
It can be, if you keep its guardrails on. The official security documentation describes eight layers of protection, including who is allowed to talk to the agent, approval prompts before dangerous commands, limits on which files it may write, container isolation, and filtering of credentials passed to MCP servers.
Several of those protections are on by default. Approval mode starts at "smart", which auto-approves low-risk commands, denies clearly dangerous ones and asks you about the rest. The messaging gateway denies every user until you add an allowlist or approve someone through pairing. Hermes secret files are on a protected-path list that the file tools refuse to write.
The docs are also candid about the limits. The file-write guards are described as defense in depth, not a hard boundary: the terminal tool runs as the same operating-system user and can still reach those files through shell commands. The prompt-injection scan of project files is a set of heuristics, not a guarantee. So "safe" depends less on Hermes itself and more on the choices covered below.
Like any fast-moving open-source project, Hermes Agent also gets security fixes regularly. The National Vulnerability Database lists more than 40 published vulnerabilities that name Hermes Agent (NVD, as of Oct 21, 2026). Staying on a current release is part of running it safely.
Hermes Agent security risks to know
Approvals turned off. Setting approvals.mode: off, or turning on YOLO mode with --yolo, /yolo or HERMES_YOLO_MODE=1, skips approval prompts for that session. Only a short hard-coded blocklist still applies. Keep approvals on anywhere the agent touches real data.
An open gateway. GATEWAY_ALLOW_ALL_USERS=true lets anyone who can message your bot give it instructions. The deployment checklist says never to use it in production. Use per-platform allowlists or pairing codes instead.
No isolation. The local terminal backend runs commands directly on the host. On a laptop that also holds your SSH keys, cloud credentials and company files, one bad command reaches all of them. Container backends such as Docker make the container the boundary.
Malicious repositories and project files. CVE-2026-71963 (published Sep 3, 2026) affected Hermes Agent 0.18.2 through 0.21.0. Opening a booby-trapped repository and sending any message could run an attacker's command and expose the provider API keys in the agent's environment. Update to a fixed release and only open repositories you trust.
Leaked provider keys. Hermes keeps API keys in ~/.hermes/.env. Loose file permissions, keys copied into front-end code, or secrets forwarded into containers through docker_forward_env or env_passthrough can all expose them. Our guides on an exposed API key in frontend code and an exposed .env file cover the fixes.
Exposed web endpoints and add-ons. CVE-2026-53869 described a DNS rebinding flaw in Hermes Agent's WebSocket endpoints before version 0.16.0 that could let a remote attacker inject commands or read terminal output. CVE-2026-82021 described a supply-chain risk in the bundled MCP catalog in 0.18.2 before 0.19.0. Keep dashboards and MCP endpoints off the public internet, and keep Hermes updated.
Hermes Agent security checklist
These best practices follow the official Gateway Deployment Checklist and the docs' guidance. Work through them before you connect Hermes to anything that matters.
- 1Set explicit allowlists. Give each messaging platform its own list of user IDs, or approve people with pairing codes. Never use allow-all in production.
- 2Use a container backend for gateways. Set
terminal.backend: docker(or another sandbox) so commands cannot touch the host. - 3Run as a non-root user. Never run the gateway as root.
- 4Keep approvals on. Use
smartormanual, and addapprovals.denyrules for anything the agent should never run, such as force-pushes. - 5Lock down secrets. Run
chmod 600 ~/.hermes/.env, use separate keys for separate services, and never commit.envfiles to version control. - 6Forward only what a task needs. Leave
docker_forward_envempty unless a specific job needs a specific credential. - 7Keep dashboards and MCP endpoints private. Bind them to localhost or put them behind authentication. They should not answer on a public address.
- 8Review your permanent allowlist. Audit
command_allowlistinconfig.yamlfrom time to time and remove patterns you no longer need. - 9Update regularly. Run
hermes updatefor security patches. - 10Only open repositories you trust. Treat an unknown repository like an unknown attachment.
For the wider set of permission and governance questions that apply to any agent, see our AI agent security checklist, and our guides to least privilege for a live AI agent and rotating secrets for a live AI agent.
What a Hermes Agent security scan can and can't see
A security review of a Hermes setup has two halves: what the outside world can reach, and how the agent is configured inside. Our free scan covers the first half.
| Free outside-in scan | Inside review |
|---|---|
| Agent dashboards that load without a login | Approval mode, YOLO use and deny rules |
| MCP endpoints that list their tools without credentials (we never run a tool) | Gateway allowlists and pairing |
| AI provider keys exposed in public pages or JavaScript (always masked) | Terminal backend and container isolation |
Public config and debug files: .env files, Git folders, source maps | Which secrets are forwarded into commands |
| Security headers and HTTPS health | Hermes version and update habits |
The scan is passive. It looks at what your host already shows the internet, the same way an attacker's first look would. If Hermes runs on a laptop behind a firewall, the scan will not see it, and that is a good sign. For AI-built apps, the same free scan also runs our Database Check. See how the AI agent security scanner works.
Check your Hermes host free
Enter your site or server address, choose "AI agent setup", and get a plain-English report in about a minute.
Want someone to review the inside configuration with you? Call 949-205-7333 or use our contact page.
Hermes Agent security FAQ
Is Hermes Agent safe to use?
It can be. Hermes ships with approval prompts, a deny-by-default messaging gateway and protected secret files. Most real risk comes from turning those off, running it without isolation, or falling behind on updates.
What are the biggest Hermes Agent security risks?
Approvals turned off or YOLO mode, a gateway open to all users, running on the local backend with no isolation, opening malicious repositories, leaked provider keys, and dashboards or MCP endpoints reachable from the internet.
Does Hermes Agent ask before running dangerous commands?
Yes, in the default "smart" mode and in "manual" mode. The "off" mode and YOLO mode skip the prompts, except for a short hard-coded blocklist. On container backends the checks are skipped because the container itself is the boundary.
Can your free scan see my Hermes Agent?
Only what is reachable from the internet: an open dashboard, an MCP endpoint that answers without credentials, exposed keys, or public config files. It cannot see an agent on a laptop or private network, and it never logs in or runs tools.
How do I audit a Hermes Agent setup?
Start with the free scan for the outside view. Then walk through the checklist above: allowlists, backend, user account, approval mode, deny rules, secret permissions, forwarded credentials and version. If you would like a second pair of eyes, contact us.
Should I run Hermes Agent on my work computer?
Read the official guide to securing Hermes on a work machine first. Prefer a container backend, keep approvals on, and set explicit allowlists before connecting it to messaging apps.