Tools AI Risk Radar ai-incident-0182
Incident record
Hermes Agent fixes login-code theft through redirects
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Hermes Agent before 0.21.6
- Actor
- researcher
What happened
Different interpretations of a redirect address could send a native-login authorisation code to an attacker’s origin. An attacker who prepared the login flow could take over the victim’s session after the victim signed in.
Tenable advisory TRA-2026-65 rates the flaw High. Hermes Agent 0.21.6 fixes it. Exploitation requires the victim to complete the attacker-prepared login flow.
Sources
- Primary disclosurewww.tenable.com/security/research/tra-2026-65
- Supporting primary sourcegithub.com/NousResearch/hermes-agent/releases/tag/v0.21.6
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026