Security

• Authorized Users
• DM / Code Pairing
• Validation of Dangerous Commands
• Protection of Sensitive Files
• Docker or SSH Isolation
• Blocking of Irreversible Commands

6. Security — A Multi-Layered Defense Ring

This is the most important chapter from a practical operating standpoint: Hermes is not a chatbot that just answers questions — it has the power to execute shell commands, read system files, and communicate over public chat channels. The official security documentation from Nous Research itself emphasizes the foundational principle: no single layer is sufficient on its own; it is the layers stacked together that create safety. Losing one layer does not mean losing all safety, but no layer should be treated as “done, no need to think further”.

The four attack classes this security model targets

Before going layer by layer, understand clearly what is being defended — four scenarios in which an automated shell agent can do harm:

1. Self-running destructive commands (rm -rf, dropping a database, git push --force onto the wrong branch).
2. Executing commands planted via prompt injection — a malicious file or web page containing text that looks like instructions, which the agent reads and mistakes for a real command.
3. Leaking secrets — reading API keys, SSH keys, .env files, then accidentally sending them off.
4. Being exploited through gateway messaging — an attacker DMs the bot, the bot complies, and data from the server leaks out.

The six sub-sections below each address one or more of these scenarios — none of them exists “just for show”.