Finding / hermes-agent
2026-10-13-hermes-agent-anthropic-labeled-custom-endpoints-no-longer-receive-refreshed-vendor-credentials
Anthropic-labeled custom endpoints no longer receive refreshed vendor credentials. An alias under the anthropic provider could point at a foreign host with no key, then refresh with ANTHROPIC_API_KEY or an OAuth token before a request or after a 401. The earlier substring check also treated a URL containing anthropic.com outside its hostname as native. The fix checks the parsed hostname before vendor credential refresh. The change explicitly identifies ~/.claude OAuth state as a shared credential source, not a bundled Claude Code agent.
Channel: tagged-release (first stable v2026.9.24). Half: defect. Date: 2026-09-23.
Operator consequence: Review custom model aliases and base URLs on earlier tags; rotate vendor credentials if route or request logs establish exposure. Preserve intentional proxy credentials separately from native Anthropic credentials.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-hermes-agent-anthropic-labeled-custom-endpoints-no-longer-receive-refreshed-vendor-credentials
Profile citations
- Hermes Agent / claim / anthropic-endpoint-credential-origin
- Hermes Agent / posture / governance
Source links
Primary links, including exact changelog lines when available.