AI 代理安全與執行環境
Hermes Agent 0.21.2 Patches Cross-Profile Data Leaks and SQLite WAL Races
Nous Research’s patch release re-separates shared state from user databases and closes pathways that allowed sessions, MCP credentials, and attachments to flow across profiles. Docker images are available, but given the patch’s broad scope and the absence of a standalone security advisory, deployers should still back up and validate their environments first.
Nous Research released Hermes Agent v0.21.2 on September 11, focusing on `state.db` corruption, locking, and isolation issues that emerged after v0.21.0 rewrote session connectivity. Previously, the profile gateway, desktop dashboard, and cron could obtain writable SQLite connections simultaneously, while raw `open()` calls could even interfere with existing POSIX locks. The new release moves hosted-room state to `shared-state.db`, makes the dashboard prefer read-only access, tracks all connections in a registry, and causes `doctor --fix` to refuse to run when it cannot establish that checkpointing is safe.
The WAL path also gains more granular failure handling. Deleted dentries on OpenZFS, races between closing connections and adding new messages, and transient WSL2 I/O errors no longer immediately cause a healthy database to be marked as permanently corrupted. FTS5 index failures now degrade gracefully by disabling search and scheduling a rebuild rather than blocking the entire conversation database. Anomalous timestamps, malformed JSON, and batch operations exceeding SQLite’s parameter limit are likewise handled with per-row warnings or chunked execution.
More importantly, the release patches multi-profile isolation flaws. Under races involving `HERMES_HOME`, previous versions could connect to another profile’s database, while searches using a bare session ID could expose someone else’s transcript. A secondary profile’s stdio MCP server could also receive vault secrets from the default profile, and media attachments could leak a sibling profile’s `.env`, `auth.json`, or `state.db`. Version 0.21.2 says it now binds databases, allowlists, host credentials, webhooks, and bearer tokens to the profile actually selected by routing.
This update affects both reliability and confidentiality and should not be treated as a routine patch. Official versioned images for x86-64 and Arm64 are available on Docker Hub. However, evidence of the fix’s full effectiveness comes primarily from the project’s own release notes, with no corresponding CVE, third-party audit, or quantified regression results available. Before upgrading, operators should back up every profile’s database, stop legacy gateway writers, use a versioned image digest, and test search, recovery, MCP startup, and cross-profile attachments. Databases that are already corrupted should first be examined with `hermes doctor` and read-only inspection mode to determine whether the damage is structural or limited to indexes.