Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Finding / hermes-agent

2026-10-13-hermes-agent-routed-foreign-profile-homes-no-longer-borrow-launch-process-credentials-on-a-secret-miss

Routed foreign profile homes no longer borrow launch-process credentials on a secret miss. With multiplexing off, a missing secret in a routed foreign home could fall back to the launch process environment. Desktop, cron, MCP and kanban work could use another home’s credentials. The fix stamps bound secret scopes with their home and refuses launch-environment fallback for a foreign home; own-home environment overlays remain intentional.

Channel: tagged-release (first stable v2026.9.24). Half: defect. Date: 2026-09-23.

Operator consequence: Audit profile-specific runs and credential use before v2026.9.24. A fix to multiplexed email reads did not settle all foreign-home scope paths.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-hermes-agent-routed-foreign-profile-homes-no-longer-borrow-launch-process-credentials-on-a-secret-miss

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Hermes Agent
    commit2026-10-13-hermes-agent-routed-foreign-profile-homes-no-longer-borrow-launch-process-credentials-on-a-secret-missgithub.com/NousResearch/hermes-agent/commit/2c3a75beaaf0fabc5a5dcc932d57f4be70efa3d5tagged commit file2026-10-13-hermes-agent-routed-foreign-profile-homes-no-longer-borrow-launch-process-credentials-on-a-secret-missNousResearch/hermes-agent / agent/secret_scope.py#L219-L247