An agent that changes a project’s AGENTS.md is not merely editing another Markdown file. It may be changing what the next agent session reads as standing instruction. NousResearch/hermes-agent’s August 7 public security commit makes that distinction operational: writes and patches aimed at AGENTS.md, CLAUDE.md, SOUL.md, .cursorrules, or project-local .hermes configuration now require fresh human approval.
The sharp part is what does not get to overrule that prompt. The commit says the gate still applies under yolo or auto-approve settings, grants approval for one operation only, and blocks the edit when there is no human channel to answer. That is a deliberate refusal to treat an earlier broad permission as consent to alter the instructions that can persist beyond this task.
The path matters as much as the filename
A protection named only for a tidy path is easy to walk around. Hermes’ new file-tool path normalizes and resolves both the requested path and its real path before it decides whether a target is protected. That makes a symlink, a case variant, or a path such as ./x/../AGENTS.md part of the question instead of a loophole. It also treats one protected target in a multi-file patch as a gate for the whole patch; a refusal leaves the batch unapplied rather than quietly editing the harmless-looking half.
The accompanying regression tests make the intent unusually legible. They exercise yolo-bypass attempts, repeat writes that must re-prompt, symlink and traversal cases, project-local configuration, and the no-human case. The point is not to make every file precious. Ordinary notes remain ordinary writes. The project is drawing a boundary around files whose content can outlive the current request by changing the next request’s terms.
Permission should get narrower near persistence
The first, too-generous reading would call this a prompt-injection solution. It is not. The configuration can disable the gate, and this patch does not prove coverage of every terminal route, loader, tool, or future instruction format. Nor do source tests establish a released build or an independently tested security outcome.
But the smaller claim matters. A system can safely grant an agent room to edit application code while reserving a more specific question for the moment it tries to change its own durable steering material: do you want this instruction to survive? The next public signal worth watching is an end-to-end adversarial test that follows that material from a write attempt through later instruction loading and another execution path. That is where this stop sign will either prove it belongs in a wider safety model or show its remaining gaps.