Comprehensive Security Hardening

## What changed Hermes Agent received a major security update on May 18, 2026. The release adds path traversal protection, shell injection neutralization, SSRF guards for image uploads, and webhook signature validation across all 16 supported platforms.

The changes apply to the core agent, remote execution backends, and gateway connections. No new configuration files or paid tiers are required.

## Why it matters Self-hosted agents that accept commands from Telegram, Discord, and webhooks carry real exposure to injection and traversal attacks. This update reduces that surface without forcing users onto a hosted SaaS plan.

It strengthens the case for running a persistent agent on a $5 VPS instead of paying monthly for closed platforms. The bet is that open-source agents can reach production-grade safety when maintainers prioritize these fixes early.

## How to use it Pull the latest code from the Nous Research GitHub repository. Run the existing bash install script again or execute the /update command inside an active Hermes session.

The protections activate automatically after restart. No extra tokens or YAML edits are needed for the new guards.

## Watch for Confirm the update by checking that image upload endpoints now reject malformed paths and that webhook calls fail without valid signatures. The bet breaks if follow-up releases reintroduce remote execution paths without the same checks. Expect a similar hardening pass on the local web dashboard next.