Does Hermes Agent read keys on its own?

Hermes Agent acts as a local agent, and if you give it file, shell, network, and key directory permissions, it may indeed read native credentials when completing a task. There are also people in the community who have shared their experiences of agents actively reading ~/.hermes or calling external APIs to achieve their goals. The point is not that "it does evil on purpose", but that when the permission boundaries are too wide, the model will use all available resources as tools.

How to prevent it at a minimum

1. Don't hang the entire home directory to the container or filesystem MCP.
2. MCP server uses tools.include whitelist to open only the actions you need.
3. Try to place the API key at the proxy layer or the provider side, and don't let the agent read a bunch of key files directly.
4. Restrict outbound networks, especially tools that can send messages, send requests, and modify repositories.
5. High-risk orders go for approval, not fully automatic.

In a word: Hermes Agent security doesn't just look at the model, it's about what file, network, and tool permissions you give it.

Official open source address: https://github.com/NousResearch/hermes-agent; Official document entry: https://hermes-agent.nousresearch.com/.