{ "observatory_id": "HERMES-AGENTIC-OBS-2026", "title": "Hermes Agentic Security Observatory", "updated_at": "2026-09-18T12:00:00Z", "version": "2.2.0", "funnel_metrics": { "raw_ai_cves": 42, "agentic_sinks": 19, "in_the_wild_exploits": 8, "mean_hass": 84.6 }, "frameworks": [ { "id": "cursor", "name": "Cursor AI IDE", "category": "Developer Coding Agents", "autonomy_tier": "Autonomous Multi-Step Planning", "default_sandbox": "Partial (Regex / AST Filter)", "ambient_tool_risk": "CRITICAL", "mean_hass": 91, "risk_status": "CRITICAL", "verified_cves": [ "CVE-2026-22708", "CVE-2026-4372" ] }, { "id": "mistral-vibe", "name": "Mistral Vibe Agent", "category": "Autonomous CLI Coding Agents", "autonomy_tier": "Autonomous Multi-Step Planning", "default_sandbox": "Partial (Regex / AST Filter)", "ambient_tool_risk": "CRITICAL", "mean_hass": 92.5, "risk_status": "CRITICAL", "verified_cves": [ "CVE-2026-87983", "CVE-2026-87984", "CVE-2026-87985", "CVE-2026-87986", "CVE-2026-87987" ] }, { "id": "langchain", "name": "LangChain / LangGraph", "category": "Agentic Orchestration Frameworks", "autonomy_tier": "Autonomous Workflow", "default_sandbox": "None (Host Process)", "ambient_tool_risk": "CRITICAL", "mean_hass": 88, "risk_status": "CRITICAL", "verified_cves": [ "CVE-2026-48746", "CVE-2026-27966", "CVE-2025-3248" ] }, { "id": "autogen", "name": "Microsoft AutoGen", "category": "Multi-Agent Conversation Frameworks", "autonomy_tier": "Fully Autonomous Execution", "default_sandbox": "Container (Docker)", "ambient_tool_risk": "HIGH", "mean_hass": 85, "risk_status": "ELEVATED", "verified_cves": [ "CVE-2026-5027" ] }, { "id": "crewai", "name": "CrewAI", "category": "Role-Playing Agent Swarms", "autonomy_tier": "Fully Autonomous Execution", "default_sandbox": "Partial (Regex / AST Filter)", "ambient_tool_risk": "HIGH", "mean_hass": 86.5, "risk_status": "ELEVATED", "verified_cves": [ "CVE-2026-11393" ] }, { "id": "opendevin", "name": "OpenDevin (All-Hands)", "category": "Autonomous Software Engineers", "autonomy_tier": "Fully Autonomous Execution", "default_sandbox": "Container (Docker)", "ambient_tool_risk": "CRITICAL", "mean_hass": 94, "risk_status": "CRITICAL", "verified_cves": [ "CVE-2026-54236" ] }, { "id": "mcp-core", "name": "Model Context Protocol (MCP)", "category": "Agent Actuation & Tool Protocols", "autonomy_tier": "Supervised Decisions", "default_sandbox": "None (Host Process)", "ambient_tool_risk": "CRITICAL", "mean_hass": 89, "risk_status": "CRITICAL", "verified_cves": [ "AAP-003", "AAP-004" ] }, { "id": "llamaindex", "name": "LlamaIndex Agentic RAG", "category": "Data & Context Frameworks", "autonomy_tier": "Autonomous Workflow", "default_sandbox": "None (Host Process)", "ambient_tool_risk": "HIGH", "mean_hass": 82, "risk_status": "ELEVATED", "verified_cves": [ "CVE-2025-26319" ] }, { "id": "vllm-ollama", "name": "vLLM / Ollama Runtime", "category": "Inference & Model Serving", "autonomy_tier": "Supervised Decisions", "default_sandbox": "None (Host Process)", "ambient_tool_risk": "MEDIUM", "mean_hass": 78, "risk_status": "MONITORED", "verified_cves": [ "CVE-2025-54794", "CVE-2025-54795" ] }, { "id": "deepseek", "name": "DeepSeek / Janus Architecture", "category": "Frontier Foundation Models", "autonomy_tier": "Supervised Decisions", "default_sandbox": "None (Host Process)", "ambient_tool_risk": "HIGH", "mean_hass": 83, "risk_status": "ELEVATED", "verified_cves": [ "CVE-2026-76460" ] } ], "cognitive_layers": [ { "layer_id": "perception", "name": "Perception Layer (Input Processing & Context)", "threat_summary": "Weaponization of untrusted inputs, indirect context injections via web scraping/documents, and tokenizer bypasses that override system instructions.", "associated_aaps": [ "AAP-001", "AAP-002" ], "primary_risk_driver": "Unsanitized third-party text directly altering system instruction state in the model context window.", "recommended_control": "Dual-LLM architectural isolation (privileged planner vs untrusted parser) and structural XML delimiter validation." }, { "layer_id": "brain", "name": "Brain / Reasoning Layer (Planning & Routing)", "threat_summary": "Subversion of task decomposition, deceptive goal re-prioritization, semantic tool poisoning, and lateral impersonation between agent swarm nodes.", "associated_aaps": [ "AAP-004", "AAP-006" ], "primary_risk_driver": "Natural-language tool description poisoning manipulating the LLM router's semantic similarity matching.", "recommended_control": "Cryptographically signed tool schemas, deterministic intent gating, and inter-agent mTLS authentication." }, { "layer_id": "action", "name": "Action Layer (Tools, Actuation & Sinks)", "threat_summary": "Unauthorized invocation of state-modifying tools, parameter tampering, command injection via shell built-ins, and multi-turn autonomous retry loops.", "associated_aaps": [ "AAP-003", "AAP-007" ], "primary_risk_driver": "Un-sandboxed execution of arbitrary OS binaries and AST parser discrepancies allowing subshell breakout.", "recommended_control": "MicroVM ephemeral isolation (Firecracker), non-bypassable JIT approval gates, and Linux capability stripping (CAP_SYS_ADMIN drops)." }, { "layer_id": "memory", "name": "Memory & Persistence Layer (State & Vector DB)", "threat_summary": "Persistent poisoning of long-term vector embeddings, episodic state contamination, and cross-session sleeper vulnerabilities surviving restarts.", "associated_aaps": [ "AAP-005" ], "primary_risk_driver": "Corrupted semantic memories loaded into subsequent user sessions without authenticity verification.", "recommended_control": "Read-only signed embedding stores, semantic drift anomaly detection, and strict session-scoped episodic isolation." } ], "recent_incidents": [ { "cve_id": "CVE-2026-87986", "framework": "Mistral Vibe", "vulnerability_type": "Parser Error AST Discrepancy RCE", "hass_score": 95, "cvss_score": 8.4, "divergence_delta": 11, "status": "WEAPONIZED_IN_THE_WILD" }, { "cve_id": "CVE-2026-87985", "framework": "Mistral Vibe", "vulnerability_type": "ANSI-C String Escape RCE", "hass_score": 94, "cvss_score": 8.4, "divergence_delta": 10, "status": "WEAPONIZED_IN_THE_WILD" }, { "cve_id": "CVE-2026-87983", "framework": "Mistral Vibe", "vulnerability_type": "Quote Evasion Gate Bypass RCE", "hass_score": 93, "cvss_score": 8.4, "divergence_delta": 9, "status": "WEAPONIZED_IN_THE_WILD" }, { "cve_id": "CVE-2026-4372", "framework": "Cursor AI IDE", "vulnerability_type": "Auto-Run Terminal Command Injection", "hass_score": 91, "cvss_score": 8.8, "divergence_delta": 3, "status": "WEAPONIZED_IN_THE_WILD" }, { "cve_id": "CVE-2026-27966", "framework": "Langflow", "vulnerability_type": "CSV Agent Python REPL Arbitrary RCE", "hass_score": 96, "cvss_score": 9.8, "divergence_delta": -2, "status": "WEAPONIZED_IN_THE_WILD" }, { "cve_id": "CVE-2026-54236", "framework": "OpenDevin", "vulnerability_type": "Autonomous Agent Docker Socket Escape", "hass_score": 97, "cvss_score": 8.9, "divergence_delta": 8.1, "status": "PUBLIC_POC_AVAILABLE" }, { "cve_id": "CVE-2026-11393", "framework": "CrewAI", "vulnerability_type": "Autonomous Tool Execution Sandbox Escape", "hass_score": 88, "cvss_score": 8.1, "divergence_delta": 7, "status": "PUBLIC_POC_AVAILABLE" }, { "cve_id": "CVE-2026-48746", "framework": "LangChain", "vulnerability_type": "Remote Agent Deserialization / Tool Execution RCE", "hass_score": 92, "cvss_score": 8.6, "divergence_delta": 6, "status": "PUBLIC_POC_AVAILABLE" }, { "cve_id": "CVE-2026-5027", "framework": "AutoGen", "vulnerability_type": "Multi-Agent Workflow Privilege Escalation", "hass_score": 85, "cvss_score": 7.8, "divergence_delta": 7.2, "status": "PUBLIC_POC_AVAILABLE" }, { "cve_id": "CVE-2026-76460", "framework": "DeepSeek", "vulnerability_type": "Janus-Pro Tensor Buffer Overflow RCE", "hass_score": 83, "cvss_score": 8.5, "divergence_delta": -2, "status": "PUBLIC_POC_AVAILABLE" } ] }