The threat model: what you are protecting against
Starting a security conversation with "which setting should I turn on" is the wrong order. First you need to know what you are protecting against. The docs state Hermes's threat model explicitly:
- The honest-but-wrong agent — the primary focus: the model produces a destructive command by mistake, not by malice
- Prompt injection — through context files and project data
- Credential exfiltration — through generated code or tool output
- SSRF — requests against internal and cloud infrastructure
- Supply-chain poisoning — in Python dependencies
The docs are candid about a limit: the system is not designed to sandbox deliberately adversarial processes. Command checks, deny rules and pattern scanners exist to stop mistakes, not to contain an attacker. If an adversarial model is in your threat model, the boundary must be an isolated backend (Docker, a remote sandbox) — not a configuration rule.
| Threat | A realistic scenario | The main defence |
|---|---|---|
| The wrong-but-honest agent | "Clean up old files" → `rm -rf` in the wrong directory | The approval flow, deny rules, checkpoints |
| Prompt injection | A hidden instruction in a repo's `AGENTS.md` | Context-file scanning, a narrow toolset |
| Credential leakage | A script reads `.env` and sends it out | Sandbox env filters, protected paths |
| SSRF | The agent requests the cloud metadata endpoint | The always-on SSRF blocklist |
| Supply chain | A poisoned Python package arrives as a dependency | The advisory scanner, `hermes doctor` |
The defence is not a wall but a layered approach. In practice that means no single setting protects you — but several together make a real difference. The next five topics open those layers one by one: approval, isolation, secrets, network and the enterprise level.
The most important mental model: the agent's permissions are your permissions. On the local backend the agent runs as your user account — it can read everything you can read and write everywhere you can write.
Practice. Write a one-page threat model for your own environment: what data can the agent reach, which systems can it touch, and what is the worst case? Five sentences is enough. Done means: you can name the worst case concretely (for example: "my read-write key to the production database is in .env").
📚 Sources and documentation
- Security guideofficialhermes-agent.nousresearch.com
The threat model, the layers and the exact names of every setting.
- Tools and backendsofficialhermes-agent.nousresearch.com
- Configurationofficialhermes-agent.nousresearch.com