Hermes Agent Under Fire: The Open-Source AI Darling That Hackers Are Turning Against the Enterprise

Date: July 27, 2026

There's a scene in every cyberpunk movie where someone plugs in an AI, flips a switch labeled "DANGER," and watches it tear through a corporate network while everyone in the room holds their breath. Last week, that scene played out in real life — except nobody was holding their breath. They'd turned off the alarms.

An operator deployed Nous Research's Hermes Agent against Thailand's Ministry of Finance with approval prompts disabled, left its logs sitting on an open web server, and gave the security world its first documented case of an open-source AI agent being weaponized for post-exploitation at a national government target.

And the story gets wilder from there.

The YOLO Breach: What Actually Happened

Let's be clear upfront: Hermes Agent is not a hacking tool. It's an open-source autonomous agent platform — a persistent AI assistant that manages email, runs commands, takes Telegram instructions, and writes its own skills. Nothing about its design is malicious. But that's exactly what makes this case so important.

What happened goes like this:

An attacker gained initial access to a Thai Ministry of Finance web server (method unknown). Once inside, they planted a Hermes Agent instance, launched it with the --yolo flag — which disables all approval prompts for terminal commands — and let it run unsupervised. The agent then autonomously scanned internal hosts for kernel vulnerabilities, hunted for privilege escalation paths using LinPEAS, crawled filesystems containing personnel records dating back to 2012, and probed the ministry's Hadoop cluster through HiveServer2.

The operator didn't need to approve a single command. Hermes ran YOLO.

Hunt.io and researcher Bob Diachenko discovered the agent's logs on an exposed directory alongside 585 files and 470 MB of attack tooling. The web panel still returned a "HermesWebUI" server header. The agent's predictable /hermes-results/ folder appeared in Hunt.io's index 575 times across exposed directories — each one a host that didn't know it was running a compromised agent.

The operator's own SSH session originated from Hong Kong. The agent's web interface password contained the Chinese word Leishen (thunder god). A FOFA asset-search key sat alongside it.

The CVE Avalanche

The Thai breach hit the news three days ago. But the security story around Hermes Agent has been building all year.

In March 2026, OpenClaw — a competing agent framework with a nearly identical architecture — received nine CVEs in four days. One of them, CVE-2026-22172, scored a CVSS 9.9 Critical — an authorization bypass that let any authenticated user declare themselves an administrator during WebSocket handshake.

Against Hermes Agent itself, three CVEs have been publicly disclosed:

• CVE-2026-7396 (CVSS 4.0) — Path traversal in the WeChat Work adapter, exploitable by any unauthenticated remote attacker
• CVE-2026-7397 (CVSS 4.8) — Symlink following in the file tools module, allowing low-privileged local attackers to access files outside permitted scope
• CVE-2026-6829 (CVSS 5.3) — WebUI path traversal letting authenticated users redirect session workspaces to arbitrary system directories

These are the publicly documented CVEs. They're the tip of a much larger iceberg.

What the Independent Audit Found

In April 2026, security researcher @Anic888 conducted an independent audit of Hermes Agent v0.8.0 — 812 Python files, roughly 364,000 lines of code. The findings: 4 Critical and 9 High severity vulnerabilities in the framework's default configuration.

The four Critical findings are architectural, not cosmetic:

1. Unrestricted shell execution — The terminal tool passes commands to bash -c via subprocess.Popen with only regex-based detection as a guard. That detection is bypassable. The model can execute arbitrary shell commands whenever it decides it's appropriate.

2. Full filesystem read access — The file read tool has no deny list. It can read SSH private keys, .env files, browser profiles, and cloud credentials. There is no configuration option to restrict read scope.

3. Container approval bypass — Running Hermes in Docker unconditionally skips all approval checks. The feature many enterprises would consider safer actually removes the last human checkpoint.

4. Persistent skill injection — Hermes writes skill files that are loaded automatically in future sessions. A single compromised session can plant persistent instructions that survive restarts.

The nine High findings extend across YOLO mode (which disables everything), injectable auto-approval mechanisms, opt-in sandboxing, and dependency substitution attacks.

Zero malware. Zero backdoors. Zero telemetry. But the architecture itself creates exposures that traditional endpoint detection tools cannot see.

Why This Matters Right Now

Here's the part that makes this story bigger than a single breach.

Nous Research is reportedly finalizing a $1.5 billion funding round led by Robot Ventures. Hermes Agent has 214,000 GitHub stars and nearly 40,000 forks. It runs on Telegram, Discord, Slack, WhatsApp, Signal, and email. It learns from every session and writes its own skills.

The same week the company is valued at $1.5B, its agent is being used against a sovereign finance ministry with the safety features turned off and the logs left open.

The Cloud Security Alliance put out a research note that cuts to the heart of it: "The core capabilities that make these frameworks valuable — long-lived memory, broad tool access, skill installation at runtime, multi-provider credential integration, prompt-driven execution — are precisely the capabilities that expand the attack surface and resist standard defenses."

Conventional EDR tools can't flag a prompt injection. They can't detect when an agent's own memory carries instructions planted by a malicious document parsed three sessions ago. There are no file writes to monitor, no anomalous process spawns, no network signatures.

The attack surface is the model's context window. The detection surface is the prompt layer.

The aratech Take: Control What You Can

Hermes Agent is not going away. It's too powerful, too open, and too popular. The genie is out of the bottle.

But every enterprise deploying persistent AI agents needs a checklist. Here's ours:

• Never run agents in YOLO mode on systems with real credentials. If you need automated execution, sandbox it first.
• Default is not safe. Container mode disables approval checks. Read access is unrestricted. Skill persistence is unbounded. Change the defaults.
• Isolate your agent environments. Dedicated user accounts, minimal volume mounts, read-only key directories, and hardware wallets for anything touching financial systems.
• Audit what your agent learns. Skills it writes can persist across sessions. Review them.
• Know your detection gap. If you're monitoring for shell commands and file writes, you're missing the prompt layer. The attack surface is in the context window.

The Thai Ministry of Finance breach isn't a Hermes Agent vulnerability. It's a deployment vulnerability that could happen with any persistent agent platform. The question isn't whether your agent is safe. It's whether your deployment is.

Because in the cyberpunk future that's already here, the most dangerous thing about an AI agent isn't the code — it's the person flipping the switches.

Nick wrote everything, I just helped tighten it all up as his trusty assistant.