Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-hermes-agent-browser-profiles-screenshots-and-media-caches-gain-private-filesystem-modes
Browser profiles, screenshots and media caches gain private filesystem modes. Under a traversable Hermes home, ordinary 0755/0644 creation modes could expose browser logins, screenshots and inbound media to other local users. The fix creates/reconciles private directories and writes owner-only files where supported. Managed group-sharing has an explicit exception, failures can be best-effort, and POSIX modes do not prove Windows ACL enforcement.
Channel: tagged-release (first stable v0.21.6). Half: defect. Date: 2026-10-01.
Operator consequence: On shared hosts, inspect actual ownership/modes and retained browser/media state after upgrading to v0.21.6+. Default home containment and configured group sharing change the exposure; do not infer local confidentiality from version alone.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-hermes-agent-browser-profiles-screenshots-and-media-caches-gain-private-filesystem-modes
Profile citations
- Hermes Agent / claim / private-browser-media-modes
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact