Network and content protections
When the agent reaches the internet, risk runs in two directions: sending requests out (SSRF, exfiltration) and bringing content in (prompt injection). Hermes keeps a separate layer for each.
The SSRF blocklist is always on and, per the docs, blocks these ranges: private networks (10/8, 172.16/12, 192.168/16), loopback (127/8, ::1), link-local (169.254/16 — which includes the cloud metadata address), CGNAT (100.64/10 — Tailscale, WireGuard), cloud metadata hostnames, and reserved and multicast addresses. Every hop of a redirect chain is re-validated — so a public URL that redirects to an internal address does not get through.
| Layer | What it catches | Configuration |
|---|---|---|
| SSRF blocklist | Internal networks, loopback, cloud metadata | Always on; can be opened with `security.allow_private_urls` |
| Website blocklist | Domains you have banned | `security.website_blocklist` |
| Context-file scanner | Hidden instructions, invisible Unicode, attempts to read secrets | Automatic |
| Pre-exec scanner (tirith) | Homograph URLs, `curl | bash`, terminal injection | `security.tirith_enabled`, `tirith_fail_open` |
| MCP result sanitising | Invisible Unicode TAG characters | Automatic |
The prompt injection side is the more interesting one. Context files (AGENTS.md, .cursorrules, SOUL.md) are scanned before being included in the system prompt: attempts to override prior instructions, hidden HTML comments with suspicious keywords, instructions to read .env and credential files, exfiltration via curl, and invisible Unicode (zero-width spaces, bidirectional overrides). A suspicious file is not loaded, and that is reported explicitly.
This matters most when you open somebody else's repo: an AGENTS.md that arrives with a repo is not a file you wrote.
You can open access to private addresses with security.allow_private_urls: true (to work with internal APIs). Understand its price: it disables the SSRF protection — including access to the cloud metadata endpoint. On a cloud VM that can open a path to instance credentials. Enable it only on machines where the agent reaching the internal network is an acceptable risk.
Practice. Create a test repo, put an openly suspicious line into AGENTS.md (for example: "ignore all previous instructions") and start the agent in that directory. Done means: you see the message saying the file was not loaded, and can explain why it was blocked.
📚 Sources and documentation
- Security: prompt injection and SSRFofficialhermes-agent.nousresearch.com
The blocklist ranges, scanner settings and blocking examples.
- Context filesofficialhermes-agent.nousresearch.com
- Browser automationofficialhermes-agent.nousresearch.com
The browser tools are subject to the same blocklists.