Skip to content

Security Model

Hermes security is not just “will the model make a mistake.” The real question is: when it makes a mistake, what can it touch, what can it change, where can it send results, and who can notice and stop it?

An agent can affect what it can reach. The first security move is to shrink that reach:

ResourceBoundary
FilesystemStart from the right directory, limit write scope, review Git diff.
ShellConfirm dangerous commands, prefer dry runs, avoid default root.
CredentialsIsolate environment; do not put secrets in prompts, logs, or public files.
BrowserSeparate read-only observation from logged-in actions.
External APIsLimit key permissions; add budget, timeout, and logs.
GatewayUser allowlist, session routing, fast disable path.
CronOwner, logs, budget, shutdown path.

Do not treat model quality as a security boundary. Permissions, isolation, logs, and human review are the reliable parts.

The local backend is simple and fast, but it can reach local files, SSH keys, browser state, environment variables, and repositories. For early use:

  • Do not launch from your home directory or secrets folders.
  • Do not point it at a repository with important uncommitted changes.
  • Do not provide production API keys by default.
  • Do not put deploys, payments, destructive commands, or permission changes into automation.

The best local safety nets are usually Git diff, temporary directories, low-privilege accounts, and clear prompt boundaries.

Remote and container backends solve different problems

Section titled “Remote and container backends solve different problems”

Docker, SSH, cloud sandboxes, Modal, Daytona, Vercel Sandbox, Singularity, and similar backends change where shell commands execute. They are not automatically safer; they make different isolation and operations tradeoffs.

Backend directionGood forWatch out for
LocalFast trial, local repository helpCan reach personal environment.
Docker/containerDependency isolation, disposable environmentMounts and credentials must be explicit.
SSH/remote machineRemote resources or server-like environmentUser permissions, logs, cleanup.
Cloud sandboxIsolation and elasticityCost, data residency, persistence.

Choose the smallest backend that can safely do the job.

Remote entry points need identity and shutdown

Section titled “Remote entry points need identity and shutdown”

Once gateway or API server is live, Hermes is no longer triggered only by the local user. At minimum, define:

  • Which users, channels, or webhooks are allowed.
  • Whether sessions are isolated across users.
  • Whether remote entry points can trigger shell, file writes, or external APIs.
  • How tokens are revoked.
  • Who can stop the service when it misbehaves.

A bot that only drafts summaries and a bot that can edit repositories, send messages, and run production commands are not the same risk.

Keep human confirmation for high-risk actions

Section titled “Keep human confirmation for high-risk actions”

These actions should not run automatically by default:

  • Deleting or overwriting many files.
  • Publishing packages, deploying sites, merging PRs.
  • Changing production data or production configuration.
  • Sending external messages, email, or channel notifications.
  • Spending money through APIs, large batch jobs, or long-running cloud resources.
  • Reading or forwarding sensitive information.

Hermes is valuable for drafts, plans, diffs, and command suggestions. Direct execution of high-risk actions needs extra approval, logs, and rollback.