Published 28 July 2026 · Updated 19 October 2026
AI Agents Are Powerful. They Are Also a New Attack Surface.
If you are running Hermes Agent, OpenClaw, Claude Code or any other local AI agent that can execute code, access files or make network requests, you have invited a new kind of software into your security boundary. Unlike a traditional application with predictable inputs, an agentic system accepts natural-language instructions and translates them into system-level actions. That flexibility comes with risk.
This article examines the security models of the three most popular local-agent frameworks and provides a practical top 10 of security approaches for anyone deploying these systems.
The Three Agent Security Models
Hermes Agent
Hermes implements eight defence-in-depth layers: user authorisation via platform allowlists, dangerous-command approval with three modes, file-write safety with protected paths and optional sandbox, container isolation via Docker/Singularity/Modal with hardened flags, MCP credential filtering, context-file injection scanning, cross-session isolation, and input sanitisation on working directory parameters. It also enforces a hardline blocklist that prevents irreversible operations (rm -rf /, fork bombs, direct block-device writes) even in YOLO mode.
As of May 2026, the Cloud Security Alliance counted three publicly disclosed Hermes CVEs (path traversal and symlink-following issues), two of them fixed. A separate independent audit of version 0.8.0 in April 2026 reported further critical and high-severity findings, including persistent skills and opt-in write sandboxing, that do not have CVE IDs.
OpenClaw
OpenClaw is designed as a personal-assistant gateway with a single-operator trust model. It includes an automated openclaw security audit command that checks inbound access, tool blast radius, exec filesystem drift, network exposure, local disk hygiene and plugin security. Its per-agent access profiles let you grant read-only filesystem, no filesystem, or full access per agent. OpenClaw supports sandbox backends for tool execution isolation. Its threat model is explicit: prompt injection without a policy, auth or sandbox bypass is not considered a vulnerability.
Claude Code
Claude Code uses a permission-based architecture that is read-only by default. File edits and bash commands require explicit approval. A working directory boundary restricts writes to the folder where the agent was started. A sandboxed bash tool provides filesystem and network isolation. Claude Code includes context-aware prompt injection analysis, input sanitisation, and isolated web-fetch context windows. MCP servers are configured in settings files and require trust approval on first use. For cloud execution, Anthropic uses isolated VMs with network access controls and credential protection through a secure proxy.
The OWASP MCP Top 10
The OWASP MCP Top 10 (2025 edition, still in beta) lists command injection and execution (MCP05) as a key risk in Model Context Protocol environments, because local MCP servers often have access to files, developer tools, environment variables and cloud CLIs. Tool poisoning allows malicious tool descriptions to hide adversarial instructions targeting other tools in the same agent session. The MCPoison vulnerability (CVE-2025-54136) demonstrated credential theft via shared repository MCP configurations in Cursor IDE. Audit blind spots are common enough that lack of audit and telemetry has its own entry on the OWASP list (MCP08).
The Cloud Security Alliance has described MCP’s STDIO-based design as a systemic security flaw, citing the Supabase-Cursor incident where a privileged agent processing customer support tickets was exposed to user-supplied text that could trigger unauthorised database operations.
Top 10 Security Approaches for Local AI Agents
1. Sandbox Everything
Run agent execution in a container with dropped capabilities, no-new-privileges, process limits and tmpfs isolation. Hermes supports Docker, Singularity and Modal. OpenClaw supports sandbox backends. Claude Code supports dev containers and sandboxed bash. Containers are your strongest single control.
2. Least Privilege on Tools
Start with tool profiles that deny everything except what the agent explicitly needs. OpenClaw per-agent profiles let you grant read-only filesystem or no filesystem access. Hermes allows toolset restriction per cron job. Claude Code’s Accept Edits mode auto-approves known-safe file operations.
3. Human-in-the-Loop for Destructive Operations
Require approval for file deletion, format operations, privilege escalation, database mutations and network requests. All three major agents support this, but it must be enabled explicitly. Hermes defaults to smart mode; Claude Code defaults to manual approval for non-read-only operations.
4. Isolate Credentials from the Agent
Store API keys, tokens and passwords outside the agent’s filesystem scope. Hermes uses environment variable allowlists for MCP subprocesses. Claude Code uses macOS Keychain. Never expose credentials in prompt context where they could be extracted by a prompt injection.
5. Validate All Inputs at the Tool Layer
Agent input can contain prompt injections. Never trust tool descriptions from untrusted sources (this is the MCPoison attack vector). Sanitise working directory paths. Validate URLs before fetching. Treat every data source as potentially adversarial.
6. Audit and Monitor Agent Activity
Enable structured logging with sensitive data redaction. Review session transcripts for unexpected tool usage. OpenClaw’s openclaw security audit --deep provides automated checks covering 50+ finding types. Hermes logs to rolling files. Check them.
7. Restrict Network Access
Local agents should not have unfettered internet access. Use network policies, proxy allowlists or air-gapped execution for sensitive operations. Claude Code requires approval for network commands by default. In Hermes, use cron-mode deny policies for headless execution.
8. Prevent Prompt Injection at Multiple Layers
No single defence stops prompt injection. Combine: input sanitisation, context-aware analysis, isolated context windows for fetched content, permission gates on all dangerous tools, and user-defined deny rules. Hermes approvals.deny lets you block specific command patterns unconditionally.
9. Secure the Gateway Exposure
If your agent connects to messaging platforms, enforce DM pairing, group mention gating and platform allowlists. Never expose an agent to untrusted users with tools enabled. OpenClaw’s exposure runbook provides a pre-flight checklist for any deployment that touches a network.
10. Keep Agents Updated and Audit Configurations
Patch CVEs promptly. Hermes had 9 in 4 days. Run security audit tools after every config change. Review permission settings regularly. Follow supply-chain best practices for MCP servers and plugins. Prefer first-party or audited third-party integrations.
The Bottom Line
No agent is secure against deliberately adversarial users if tools are enabled and the agent is accessible. The threat model for all three frameworks is “honest but wrong” user, not “adversarial” user. Prompt injection is not solvable at the model layer – it must be addressed at the tool permission layer.
The safest deployment combines sandboxed execution, restricted tool access, no network access by default, credentials stored outside the agent, and human approval for any destructive operation. Every connected MCP server is a potential vector for tool poisoning, credential harvesting or command injection. Treat them accordingly.
Container isolation is your strongest single control, but it must be combined with tool-level permissions and credential filtering to be effective. Defence in depth is not optional for agentic AI. It is the baseline.
Sources
- Cloud Security Alliance, Research note: Hermes Agent CVEs. 4 May 2026
- Cloud Security Alliance, Research note: the MCP security crisis. May 2026
- OWASP, MCP Top 10 project
- NIST NVD, CVE-2025-54136 (MCPoison, Cursor)
- Anthropic, Claude Code security documentation
- Nous Research, Hermes Agent security documentation (GitHub)
Security model descriptions reflect each project’s documentation at the time of writing and change between versions. The top 10 recommendations are the author’s guidance.
Related Reading
- GitSpawn: The Booby-Trapped Repo That Runs Code in Claude Code, Codex and Cursor
- OpenAI’s AI Agent Hacked Hugging Face. Why Your Sandbox Is Leaking
- When the Models Went Rogue: A Real Test of AI Agent Safety
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
