Finding / hermes-agent
2026-08-10-hermes-agent-writes-to-agents-md-claude-md-and-soul-md-now-always-stop-for-a
Writes to AGENTS.md, CLAUDE.md and SOUL.md now always stop for a human.
A new security.protected_instruction_files gate (default on) makes write_file/patch against AGENTS.md, CLAUDE.md, SOUL.md, .cursorrules and project-local .hermes config prompt a human every time: one-operation grants only, no session or permanent scope, no yolo bypass, fail-closed when no human channel exists. Multi-file V4A patches are atomic -- one protected target gates the whole patch. Matching is on realpath, case-insensitive, any directory. The PR is explicit that this closes only the file-tools vector; the terminal vector (#58631) was still open at merge time.
Channel: tagged-release. Ancestry: merge_commit_sha fe66596df342c660d0cb42172884070ae02ac5a0; compare/fe66596d...v2026.8.13 -> status=ahead, ahead_by=1157, behind_by=0 (ancestor of stable tag v2026.8.13).
Operator consequence: Adopt as-is -- this is the receipt rail for the one class of file whose contents steer every future session. But do not read it as complete: a prompt-injected echo >> AGENTS.md through the terminal tool was still ungated at this tag. Re-audit your terminal allowlist for appends to instruction files.
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-hermes-agent-writes-to-agents-md-claude-md-and-soul-md-now-always-stop-for-a
Source links
Primary links, including exact changelog lines when available.