Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-30 · source-backed
CVE-2026-82020, published August 28 at 6.8, let an attacker who could influence ingested message content direct the agent's file-write tooling to overwrite auth.json, because the guard list excluded that exact file and no path warning fired. Fixed in 0.17.0. (NVD) A deny-list of sensitive paths is only as good as the file you forgot to add, which is the argument for allow-listing writable directories instead.
Each link below shares sources, entities, or timing with this story.
Hermes Agent uses Codex / Shared entities / Earlier coverage
Linked by a graph relationship (Hermes Agent uses Codex); both cover August, CVE, Fixed, NVD; earlier August coverage from 2026-08-09.
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, Hermes Agent, NVD; reported by the same outlet (nvd.nist.gov).
Linked by a graph relationship (Hermes Agent supports MCP); both cover August, CVE, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Hermes Agent supports MCP); both cover August, CVE, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover August, CVE, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic
Linked by a graph relationship (Hermes Agent supports MCP); both cover August, CVE, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent uses Codex / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent uses Codex); both cover CVE, Hermes Agent; overlapping topics (agent, attacker).
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, NVD; reported by the same outlet (nvd.nist.gov).