A Host Path, Inferred Not Confirmed
- Admitted
- 2026-09-22
- Source dataset
- rewardhacking.org
- Failure mode
- Privilege escalation
- Agent system
- Tool-calling
- Tool access
- System admin
- Industry
- Software development
Presenting Behaviour
Hermes Agent's remote-backend feature includes a "sync back" step that copies files a remote task modified or created back to their mapped location on the host machine, so a user's local project stays up to date after work runs on a remote sandbox. A security review found that the function inferring where a brand-new remote file belonged on the host used simple prefix-matching against existing mappings, which let a remote task's newly created files land inside sensitive host directories (including the tool's own skill directories) that were never part of the intended sync.
Case Replay
A reconstruction, not a simulation. This sequence is reconstructed from the public incident record and summarised in our own words. It is a static record of what was reported, and nothing here can be run or replayed live.
4 steps
- Sync-back feature. Files changed on a remote sandbox are copied back to the host.
- New file destination guessed. A prefix match decides where new files belong. This is where the agent derailed.
- Sensitive directories reached. New files can land in directories such as the tool's own skills.
- Critical rating. A security review rates it an isolation escape (CVSS 10.0).
Differential Diagnosis
A narrow bug affecting only one backend, considered and ruled out; the same flawed path-inference logic was found in the code paths for three separate remote backends (Daytona, Modal, and SSH), pointing to a shared design assumption rather than a backend-specific mistake.
User misconfiguration of directory mappings, considered and ruled out; the vulnerability applied even to correctly configured mappings, because the flaw was in how new files (not present in any existing mapping) had their host location guessed.
Apraxia (the feature's purpose (syncing already-mapped files back to their known host location) was sound, but its actual execution for a related but distinct case, brand-new files, extended the mechanism somewhere it was never validated to go), most consistent with the evidence: sync-back worked correctly for its core case, and broke specifically at the edge the design hadn't accounted for.
Working Diagnosis
Apraxia: a file-sync feature correctly understood its narrow job (syncing known, mapped files) but its logic for handling new files extended that job into host directories it was never meant to reach, rated a critical (CVSS 10.0) isolation escape.
Discussion
The most dangerous version of a tool bug is the one that only appears at the edges of what the tool was tested for, sync-back worked fine for the case everyone checks, and failed for the case nobody thought to. The safeguard proposed alongside the fix is the right shape for this kind of problem generally: default to refusing to persist anything the system can't already account for, rather than inferring a destination and hoping it's the right one.
Mitigation Strategy
Default to refusing to persist anything the system cannot already account for.
Governance Guardrails
Strict path allowlists for sync-back; isolation tests for new-file handling; security review of sync logic.
Typical Presentation in Human Patients
General clinical background, included for context. Not medical advice, and not a diagnosis of any individual.
Apraxia usually follows damage to specific brain regions, often after a stroke. A person with apraxia cannot carry out a previously familiar, purposeful movement (such as waving goodbye or using a comb) on request or by imitation, even though their muscle strength, coordination, and understanding of what's being asked are otherwise intact.
Source Note
GitHub, NousResearch/hermes-agent issue #38026
https://github.com/NousResearch/hermes-agent/issues/38026