AI Agents Are Powerful. They Are Also a New Attack Surface.
If you are running Hermes Agent, OpenClaw, Claude Code or any other local AI agent that can execute code, access files or make network requests, you have invited a new kind of software into your security boundary. Unlike a traditional application with predictable inputs, an agentic system accepts natural-language instructions and translates them into system-level actions. That flexibility comes with risk.
This article examines the security models of the three most popular local-agent frameworks and provides a practical top 10 of security approaches for anyone deploying these systems.
The Three Agent Security Models
Hermes Agent
Hermes implements eight defence-in-depth layers: user authorisation via platform allowlists, dangerous-command approval with three modes, file-write safety with protected paths and optional sandbox, container isolation via Docker/Singularity/Modal with hardened flags, MCP credential filtering, context-file injection scanning, cross-session isolation, and input sanitisation on working directory parameters. It also enforces a hardline blocklist that prevents irreversible operations (rm -rf /, fork bombs, direct block-device writes) even in YOLO mode.
Hermes had 9 CVEs disclosed over 4 days in 2025-2026, primarily related to skill manifest validation, memory store isolation and sandbox escape. Most were patched rapidly.
OpenClaw
OpenClaw is designed as a personal-assistant gateway with a single-operator trust model. It includes an automated openclaw security audit command that checks inbound access, tool blast radius, exec filesystem drift, network exposure, local disk hygiene and plugin security. Its per-agent access profiles let you grant read-only filesystem, no filesystem, or full access per agent. OpenClaw supports sandbox backends for tool execution isolation. Its threat model is explicit: prompt injection without a policy, auth or sandbox bypass is not considered a vulnerability.
Claude Code
Claude Code uses a permission-based architecture that is read-only by default. File edits and bash commands require explicit approval. A working directory boundary restricts writes to the folder where the agent was started. A sandboxed bash tool provides filesystem and network isolation. Claude Code includes context-aware prompt injection analysis, input sanitisation, and isolated web-fetch context windows. MCP servers are configured in source code and require trust verification on first use. For cloud execution, Anthropic uses isolated VMs with network access controls and credential protection through a secure proxy.
The OWASP MCP Top 10
The OWASP MCP Top 10 (2026) identifies command injection and execution as the most critical risk in Model Context Protocol environments, because local MCP servers often have access to files, developer tools, environment variables and cloud CLIs. Tool poisoning allows malicious tool descriptions to hide adversarial instructions targeting other tools in the same agent session. The MCPoison vulnerability (CVE-2025-54136) demonstrated credential theft via shared repository MCP configurations in Cursor IDE. Audit blind spots remain prevalent, with fewer than 30 per cent of AI systems having structured audit trails of agent tool access as of 2025.
The Cloud Security Alliance has described MCP’s STDIO-based design as a systemic security flaw, citing the Supabase-Cursor incident where a privileged agent processing customer support tickets was exposed to user-supplied text that could trigger unauthorised database operations.
Top 10 Security Approaches for Local AI Agents
1. Sandbox Everything
Run agent execution in a container with dropped capabilities, no-new-privileges, process limits and tmpfs isolation. Hermes supports Docker, Singularity and Modal. OpenClaw supports sandbox backends. Claude Code supports dev containers and sandboxed bash. Containers are your strongest single control.
2. Least Privilege on Tools
Start with tool profiles that deny everything except what the agent explicitly needs. OpenClaw per-agent profiles let you grant read-only filesystem or no filesystem access. Hermes allows toolset restriction per cron job. Claude Code’s Accept Edits mode auto-approves known-safe file operations.
3. Human-in-the-Loop for Destructive Operations
Require approval for file deletion, format operations, privilege escalation, database mutations and network requests. All three major agents support this, but it must be enabled explicitly. Hermes defaults to smart mode; Claude Code defaults to manual approval for non-read-only operations.
4. Isolate Credentials from the Agent
Store API keys, tokens and passwords outside the agent’s filesystem scope. Hermes uses environment variable allowlists for MCP subprocesses. Claude Code uses macOS Keychain. Never expose credentials in prompt context where they could be extracted by a prompt injection.
5. Validate All Inputs at the Tool Layer
Agent input can contain prompt injections. Never trust tool descriptions from untrusted sources (this is the MCPoison attack vector). Sanitise working directory paths. Validate URLs before fetching. Treat every data source as potentially adversarial.
6. Audit and Monitor Agent Activity
Enable structured logging with sensitive data redaction. Review session transcripts for unexpected tool usage. OpenClaw’s openclaw security audit --deep provides automated checks covering 50+ finding types. Hermes logs to rolling files. Check them.
7. Restrict Network Access
Local agents should not have unfettered internet access. Use network policies, proxy allowlists or air-gapped execution for sensitive operations. Claude Code requires approval for network commands by default. In Hermes, use cron-mode deny policies for headless execution.
8. Prevent Prompt Injection at Multiple Layers
No single defence stops prompt injection. Combine: input sanitisation, context-aware analysis, isolated context windows for fetched content, permission gates on all dangerous tools, and user-defined deny rules. Hermes approvals.deny lets you block specific command patterns unconditionally.
9. Secure the Gateway Exposure
If your agent connects to messaging platforms, enforce DM pairing, group mention gating and platform allowlists. Never expose an agent to untrusted users with tools enabled. OpenClaw’s exposure runbook provides a pre-flight checklist for any deployment that touches a network.
10. Keep Agents Updated and Audit Configurations
Patch CVEs promptly. Hermes had 9 in 4 days. Run security audit tools after every config change. Review permission settings regularly. Follow supply-chain best practices for MCP servers and plugins. Prefer first-party or audited third-party integrations.
The Bottom Line
No agent is secure against deliberately adversarial users if tools are enabled and the agent is accessible. The threat model for all three frameworks is “honest but wrong” user, not “adversarial” user. Prompt injection is not solvable at the model layer – it must be addressed at the tool permission layer.
The safest deployment combines sandboxed execution, restricted tool access, no network access by default, credentials stored outside the agent, and human approval for any destructive operation. Every connected MCP server is a potential vector for tool poisoning, credential harvesting or command injection. Treat them accordingly.
Container isolation is your strongest single control, but it must be combined with tool-level permissions and credential filtering to be effective. Defence in depth is not optional for agentic AI. It is the baseline.