New in Hermes Agent: a credential firewall for Docker sandboxes.
- Source
- x.com
- Date
New in Hermes Agent: a credential firewall for Docker sandboxes. Your real keys never enter the sandbox. It runs on stand-in tokens, and a local proxy swaps in the real keys at the network boundary. Tokens from a compromised sandbox are useless elsewhere. > hermes egress setup
Context
Nous Research's Hermes credential firewall separates protected API keys from the Docker where an runs code. The announcement describes giving the sandbox substitute access credentials. A proxy outside it replaces those substitutes with the real keys when forwarding requests.
The technical documentation makes the boundary more specific: the protection covers configured provider credentials and depends on a trusted proxy. It does not protect secrets separately mounted as files or prevent every misuse of an allowed connection. The design reduces exposure of reusable keys if the sandbox is compromised, while the proxy and its permitted destinations remain security-critical.
- sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
- AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
- token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
Checking sign-in…
Loading comments…