Vibe Coding
Hermes Agent's path guards excluded auth.json, so ingested content could overwrite the credential store (CVE-2026-82020)
NVD published CVE-2026-82020 on 2026-08-28 at 20:20 UTC, scored 6.8 MEDIUM: Hermes Agent 0.16.0 before 0.17.0 let an attacker who could influence ingested message content direct the agent's file-write tooling to overwrite auth.json, because the sensitive-path guard list excluded that exact file and no path-based warning fired. It landed alongside the higher-profile 8.3 supply-chain issue in the same product, and it is the cleaner lesson: a deny-list of sensitive paths is only as good as the file you forgot to add.
Source
↳ Follow the thread