AgentNo sandbox by defaultTracked every 6 hours

Hermes Agent

Agent from Nous Research (MIT, Python). Runs shell commands on the host by default, with an approval step for dangerous ones; Docker and cloud sandboxes are options. Works with many LLM providers.

By Nous ResearchLicense MITLanguage PythonFirst release 2026-02-18
GitHub stars
259,661
GitHub, 2026-11-02
Last release
v0.22.5
2026-10-23
CVEs (30 days / total)
0 / 33
from NVD
Sandbox default
no
GitHub stars, last 12 snapshots: +845

Overview

Hermes Agent's default terminal backend, local, runs commands on the host with no isolation. Commands that match its list of dangerous patterns go through an approval step: in the default smart mode a helper model approves the low-risk ones, denies the clearly dangerous ones and asks you about the rest. Its security docs advise the Docker backend (or Modal, Daytona, Vercel Sandbox) for production gateways, where the container becomes the boundary, and its security policy goes further: the approval gate is a heuristic, only OS-level isolation is a boundary, and production, shared use or untrusted input call for the whole agent inside its Docker image or NVIDIA OpenShell. The chat gateway refuses every user until one is allowlisted or paired. The security model is publicly documented.

Our take

Editorial opinion, not a test result.

Best for

  • New self-hosted AI deployments without specific constraints
  • A chat-app agent for one owner, with allowlists or pairing for who may talk to it
  • Setups that want command approvals from the first run, with a sandbox backend one setting away

Not for

  • Highly resource-constrained hosts (try Nanobot)
  • Very small hosts (look at ZeroClaw or Nanobot)
  • Setups that want untrusted tools sandboxed from the first run (look at IronClaw or NanoClaw)

Security posture

Sandbox by defaultno
Auth on dashboardyes
Threat model documentedyes
Multi-LLM supportyes
CVEs on NVD (total)33
CVEs in the last 30 days0

Off by default: the local terminal backend runs commands on the host, and commands that match its dangerous-pattern list need approval. Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox backends are one setting away.

Sources

Sandbox default and model support read in the project's own documentation and repository on 2026-10-18.

Links

Run Hermes Agent on portable hardware

Verified working on these portable hosts (with the standard caveats: see the per-device pages for power, RAM headroom, browser-tool support):

Raspberry Pi 5
€80-110 · 5-12 W
Intel NUC 13 and Geekom IT13
€300-600 · 15-55 W
Mac Mini M4 / M4 Pro
€699-2200 · 4-65 W (M4), 5-140 W (M4 Pro), idle to maximum per Apple
Framework Laptop 13 / 16
€1100-2200 · 15-80 W
Orange Pi 5 Plus
€110-250 · 8-15 W
Mac Studio M3 Ultra
€4,500-7,000 · Up to 480 W (maximum continuous)
MacBook Air M3 / M4
€1,299-2,099 · 10-25 W
Lenovo ThinkCentre M75q (used)
€150-250 used · 15-35 W
Minisforum UM790 Pro
€700-900 · 25-65 W
Khadas Edge2 Pro
€220-280 · 8-15 W
Dell OptiPlex 3070 / 5070 Micro (used)
€100-180 used · 15-35 W
Geekom Mini Air 12
€280-340 · 6-15 W

Compare Hermes Agent with others

Hermes Agent vs OpenClaw
No sandbox by default
Hermes Agent vs Nanobot
No sandbox by default
Hermes Agent vs IronClaw
Sandbox on by default

Hermes Agent CVEs (33 on NVD)

CVE-2026-71963high 8.8Hermes Agent: Remote code execution vulnerability that lets attackers execute arbitrary OS commandsHermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS…3 Sept 2026CVE-2026-85107medium 4.3Hermes Agent: Allocation of resources in Electron Main ProcessA vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file…3 Sept 2026CVE-2026-85106medium 6.3Hermes Agent: Server-side request forgery in Link Title FetchA vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file…3 Sept 2026CVE-2026-85105high 7.3Hermes Agent: Authorization bypass in Session ManagementA flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session…3 Sept 2026CVE-2026-84289medium 4.3Hermes Agent: Uncontrolled memory allocation in MCP ToolA vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the…1 Sept 2026CVE-2026-84288medium 4.3Hermes Agent: Denial of service in ACP Prompt WorkflowA vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of…1 Sept 2026

All CVEs

Stats refreshed every 6 hours from public sources (GitHub API, NVD CVE feed, CISA KEV). See our methodology for the full tracking pipeline.

See also: all AI agents, all AI CVEs, AI hardware, scan your AI stack, Pro alerts.