Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Finding / hermes-agent

2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-list

Network-exposed A2A refuses dispatch with an empty trusted-peer list. On a non-loopback bind, a token-authenticated A2A adapter with no trusted peers previously accepted peers after authentication. It now refuses dispatch unless peers are listed or allow-all is explicitly enabled. Loopback empty-list behavior remains compatible; bearer/peer-token authentication is still a precondition for network access.

Channel: tagged-release (first stable v0.21.6). Half: defect. Date: 2026-10-01.

Operator consequence: Populate A2A_TRUSTED_PEERS before upgrading exposed adapters to v0.21.6+. An empty list is no longer permission for every authenticated peer; intentional allow-all requires an explicit setting.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-list

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Hermes Agent
    commit2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-listgithub.com/NousResearch/hermes-agent/commit/a0cad39f5d55a2c7e2f0cbea2198358b5a3d55b0tagged commit file2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-listNousResearch/hermes-agent / plugins/platforms/a2a/security.py#L74-L115