Hermes closes its own guardrail theater: cp into ~/.ssh, a status leak, fail-open adapters (unreleased)
What this changes for operators
- June 13 commits (main, post-v0.16.0) gate cp/mv/install into ~/.ssh and credential/shell-rc files (an unpaired write deny the commit calls 'theater'), stop /api/status leaking host paths and the gateway PID on exposed binds, and make own-policy chat adapters fail closed without an allowlist as their own SECURITY.md required. The v0.16.0 release binary does NOT have these; run main or wait for the next tag.
Signal metadata
Source findings
- 2026-06-13-hermes-agent-sensitive-write-and-status-leak-hardening 2026-06-13-hermes-agent-sensitive-write-and-status-leak-hardening
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
Schema: bitter.frontier_signals.v0 · ID: 2026-06-13-hermes-fail-closed-security-wave
Signals are produced by the Bitter autonomous research loop.