Hermes Agent · security
Is Hermes Agent safe for company data? What we turn off
Short answer: Only with its reach cut back: the installer switches off nine Hermes tool groups plus image generation, and the unit cannot send or delete.
Hermes Agent is useful because it reaches far: it can run commands, browse and write skills it keeps. For a company inbox that reach is the exposure, and public reports list three CVEs and an open audit issue; we checked each against a Staffbox unit on 14 October 2026 (below). So a Staffbox unit starts with the reach removed, keeps the model on the box, and puts in writing what it still cannot promise. Have a security question about your own setup? Ask it in the form below; a person on our team replies.
Updated 14 October 2026 · built on Hermes Agent, not affiliated with Nous Research
Staffbox is built on Hermes Agent (Nous Research, MIT license). Staffbox is not affiliated with Nous Research.
Public reports make the tool list a decision, not a default
Whether a general agent is safe for your files comes down to three settings you control: which tools stay on, who can send it messages, and whether a person approves what it does. The default setup suits capable users who accept risk. We have not audited Hermes Agent's whole codebase; we checked the published CVEs against this setup (CVE check below). The items below are reports by others, dated and linked; treat them as pointers, not findings.
| Report | Date | Source |
|---|---|---|
| A Cloud Security Alliance research note listing three CVEs disclosed against Hermes components: CVE-2026-7396, CVE-2026-7397 and CVE-2026-6829. The note's "nine CVEs in four days" figure refers to OpenClaw, a different agent platform. | 4 May 2026 | labs.cloudsecurityalliance.org (as reported) |
| A GitHub audit issue (7826) reporting 4 critical and 9 high findings, including that agent-written skills can persist as a prompt-injection route | Seen 13 Oct 2026 | Hermes Agent issue 7826 (as reported) |
| A report of an operator running Hermes with approval prompts off during an intrusion | 24 Jul 2026 | The Hacker News (as reported) |
None of these shows that Hermes Agent is unsafe for every use. Each one is a reason to decide the tool list on purpose before company data goes near it.
The installer removes nine tool groups and image generation, none of which a quote drafter uses
The default install turns off nine tool groups (terminal, code execution, browser, computer use, web, outside connections, delegation, scheduled jobs and text-to-speech) plus image generation. A quote drafter reads a price list and a request and writes a reply. It has no use for a shell, a browser or the power to start other agents, and every tool left out is one less path an attacker can use. What remains: the worker writes draft replies into a drafts folder and one log line per task. The file and skills tools stay on, so it can still write files the unit's user can write. Today, if the installer cannot switch a tool group off, it warns rather than stops (a fail-closed fix is in review). It has no permission to send email or delete files, and there is no sending code in Staffbox; a person sends.
Around the agent, the model stays on 127.0.0.1 and customer data stays on the box
Cutting tools limits what the agent can do. The rest of the security sheet limits where data can go if something still goes wrong.
| Question | Answer (demo unit, 1 Oct 2026 where measured) |
|---|---|
| Where do models run? | On the Mac, through Ollama on 127.0.0.1 only. No cloud fallback provider is configured. Cloud only if the customer asks in writing and supplies its own key. |
| Network | macOS firewall and stealth mode: set at install by your IT provider from our checklist (not yet automated in the installer; an opt-in hardening step is in review); verified on our demo unit 1 Oct 2026. No inbound ports except SSH. The Hermes dashboard listens on 127.0.0.1:9119 (loopback only, this Mac). |
| Remote access | SSH keys only, password login off: set at install by your IT provider from the same checklist; verified on our demo unit 1 Oct 2026. Keys belong to named people. macOS logs every SSH login. |
| Disk | FileVault, set at install: the installer stops without FileVault on customer units. Our demo unit ran with the DEMO_UNIT=1 override, so its disk is not encrypted. |
| What leaves the box? | The agent sends no customer data out: models run on the Mac and no cloud provider is configured. An outbound traffic allowlist is planned, not in place (see the trust page). Installs and updates download Hermes, Ollama, models and Obsidian. |
| Updates | Manual today: we re-run your tests before and after each monthly update. A scripted update and rollback are in review. |
| Training | No one trains a model on customer data. |
| Exit | Unit returned or wiped in front of the customer; Staffbox deletes its copies within 14 days and confirms in writing. |
The full sheet is at the trust page. Several items are "set at install" and are checked per site, not proven in advance.
Prompt injection, certification and insurance remain open
- No SOC 2 or other certification.
- No cyber or errors-and-omissions insurance confirmed.
- No customer install exists, so nothing here has been through a customer's audit.
- Prompt injection is not solved. A request email could contain instructions aimed at the model. Our defence is structural, and partial. Terminal, code execution and seven other tool groups are off; the file and skills tools stay on, so the agent can still write files the unit's user can write. That is why the unit holds only your price list and notes, a person approves every draft, and a write safe-root and a separate low-privilege user are in review.
If your security team needs more, say so in the free test conversation and we will tell you plainly what exists. See also what Staffbox does not do and human approval of AI drafts.
Six questions show whether any Hermes deployment is locked down
Use these on any vendor, including us. A good answer is a list or a setting, never an adjective.
- Which tools are on? Ask for the list, not "it is locked down".
- Can it send or delete? If yes, who approves each one?
- Who can message it? Is there an allowlist?
- Where does the model run, and is the model port exposed?
- What leaves the machine, and when?
- Who updates it, and what is re-tested first? (Staffbox: manual today; we re-run your tests before and after each monthly update. A scripted update and rollback are in review.)
Related: Hermes Agent and email (drafts only, a person sends) · Hermes Agent with Ollama (the settings the demo unit uses) · Hermes Agent on a Mac mini (what a 16 GB M4 did on a quoting task) · back to the Hermes Agent hub.
CVE check, 14 October 2026
Three CVEs name Hermes Agent or its ecosystem. CVE-2026-7397 (macOS symlink bypass of the file-write deny list) was fixed in Hermes Agent 0.9.0 in April 2026; units installed since April 2026 include that fix (the installer pulls the current Hermes release on install day). CVE-2026-7396 (path traversal in the WeChat Work messaging adapter) applies only when that adapter runs. It is not fixed upstream; not reachable here because no messaging gateway is configured. CVE-2026-6829 affects hermes-webui, a separate third-party interface Staffbox does not install.
The open audit issue (#7826) still partly applies: the file and skills tools stay on, so the agent can read files the unit's user can read and keep skills it writes. That is why the unit holds only your price list and notes, and a person approves every draft. Today the installer pulls the current Hermes release on install day and does not pin a version; a change to pin it is in review.
- NVD CVE-2026-7397 · NVD CVE-2026-7396 · NVD CVE-2026-6829
- Audit issue #7826 · Issue #8733 · Cloud Security Alliance note, 4 May 2026
Questions
Is Hermes Agent secure?
We have not audited it. Public reports include three CVEs disclosed against Hermes components (CVE-2026-7396, -7397 and -6829; Cloud Security Alliance note, 4 May 2026, as reported) and a GitHub audit issue (7826). Security depends on which tools you leave on and whether a person approves actions.
What tools does Staffbox turn off in Hermes Agent?
The installer turns off nine tool groups (terminal, code execution, browser, computer use, web, outside connections, delegation, scheduled jobs and text-to-speech) plus image generation. The unit cannot send email or delete files.
Does Staffbox have SOC 2?
No. There is no SOC 2 or other certification, and no cyber or errors-and-omissions insurance is confirmed.
Can Hermes Agent be tricked by an email?
Prompt injection is a known risk for any model that reads untrusted text. Staffbox limits the damage: terminal, code execution and seven other tool groups are off and a person approves every draft. The file and skills tools stay on, so the agent can still write files the unit's user can write; that is why the unit holds only your price list and notes.
Sources
- Cloud Security Alliance research note on Hermes Agent CVEs, 4 May 2026: three CVEs against Hermes components (CVE-2026-7396, -7397, -6829); its "9 CVEs in 4 days" headline refers to OpenClaw (as reported).
- Hermes Agent issue 7826 (audit), seen 13 Oct 2026 (as reported)
- The Hacker News, 24 Jul 2026 (as reported)
- github.com/Staffbox-ai/staffbox (Staffbox code and evals/results, MIT), scripts/install.sh (safe defaults)
- Staffbox Trust Center
Or call us: 404 493 6248