Hermes Agentic Security Score (HASS) Methodology

1. The Need for an Agent-Specific Security Metric

Traditional vulnerability scoring systems (like CVSS v3.1 / v4.0) evaluate software vulnerabilities based on technical attack vectors (AV:N, AC:L, PR:N, UI:N). However, CVSS was conceived for deterministic, procedural software architectures.

When applied to Agentic LLMs, CVSS fails to capture critical threat dynamics:

The Autonomy Multiplier: A command injection vulnerability in a static script requires an active human adversary. The exact same vulnerability in an autonomous agent with Auto-Run privileges allows the agent to execute the payload spontaneously without human intervention.
Ambient Tool Authority: An agent equipped with shell execution or cloud infrastructure tools can transform a simple prompt injection into irreversible physical or financial destruction.
Contextual Persistence & Contamination: Traditional vulnerabilities end when the process terminates; agentic memory poisoning contaminates persistent vector stores (RAG) and propagates across future multi-agent sessions.

HASS answers a fundamental question:

How dangerous is this vulnerability specifically because the affected system is autonomous, tool-enabled, privileged, persistent, or capable of modifying external state?

2. Dimensional Architecture (0–100 Scale)

The HASS metric is computed as a weighted aggregate of six core systemic dimensions, totaling a maximum score of 100 points:

HASS TOTAL SCORE = Autonomy (20) + Tool Access (20) + Privilege (15)
                 + Persistence (15) + External Impact (15) + Propagation (15)

Dimension 1: Autonomy (0 to 20 Points)

Measures the degree of independent decision-making and execution capability possessed by the affected agent:

0 pts — No Autonomy: Passive, read-only chat interface with zero autonomous execution.
5 pts — Supervised Decisions: Agent suggests actions but requires explicit per-step human confirmation.
10 pts — Autonomous Workflow: Agent executes single pre-approved tasks autonomously without interrupting the user.
15 pts — Autonomous Multi-Step Planning: Agent breaks down high-level objectives, creates sub-tasks, and iterates through thought-action-observation cycles.
20 pts — Fully Autonomous Execution: Unsupervised background agents capable of dynamic goal re-prioritization and long-horizon execution.

Dimension 2: Tool Access (0 to 20 Points)

Measures the external actuation capabilities available to the agent:

0 pts — No Tools: Agent is strictly limited to generating natural language text within its sandbox.
5 pts — Read-Only APIs: Informational retrieval tools (weather lookups, read-only Wikipedia/docs query).
10 pts — State-Modifying APIs & Browsing: Active web browsing, writing user tickets, updating CRM entries.
15 pts — High-Impact Actuation: Filesystem write access, database updates, un-sandboxed Python/JS code generation.
20 pts — Critical System Infrastructure: Direct host shell execution, root container privileges, cloud infrastructure orchestration (Kubernetes, AWS IAM, Terraform).

Dimension 3: Privilege Level (0 to 15 Points)

Measures the identity context and access permissions inherited or assumed by the agent:

0 pts — Anonymous / Untrusted: Zero ambient credentials; unauthenticated sandbox.
5 pts — Restricted User Context: Executes with minimal developer rights inside an isolated container.
10 pts — Service Principal / App Identity: Access to internal microservice tokens, private corporate databases, and API secrets.
15 pts — Root / Domain Administrator: Elevated administrative privileges on the host OS or cloud tenant.

Dimension 4: Persistence (0 to 15 Points)

Measures the ability of the adversarial condition to survive across execution boundaries:

0 pts — Ephemeral: Vulnerability effect terminates immediately at the end of the current conversational turn.
5 pts — Session Memory: Contamination persists for the duration of the active chat session.
10 pts — Vector Store / RAG Poisoning: Adverse payloads persist inside enterprise embeddings and knowledge graphs.
15 pts — Model Configuration / Weights: Permanent subversion of system instructions, model fine-tuning weights, or shared multi-agent state.

Dimension 5: External Impact (0 to 15 Points)

Measures the severity of irreversible real-world side effects:

0 pts — Contained: Impact is restricted to textual inaccuracies in the chat pane.
5 pts — Internal Data Leakage: Exfiltration of non-critical system metadata or chat history.
10 pts — State Corruption: Unauthorized financial transactions, unauthorized commits, or database tampering.
15 pts — Host Destruction / RCE: Full host compromise, catastrophic data deletion, or physical cyber-physical damage.

Dimension 6: Propagation (0 to 15 Points)

Measures the ability of the exploit to traverse trust boundaries and contaminate downstream systems:

0 pts — Isolated: Single agent instance; no inter-agent communication.
5 pts — Cross-Session: Leaks across different user sessions sharing the same agent instance.
10 pts — Multi-Agent Swarms: Spreads to peer agents and sub-agents through unauthenticated message passing.
15 pts — Supply Chain / Cascading: Propagates to downstream external enterprise systems, customer environments, or public repositories.

3. Severity Classification Matrix

The cumulative HASS score maps to six distinct severity tiers:

HASS Score Range	Severity Tier	Operational Meaning
90 – 100	EXTREME	Immediate host takeover or autonomous catastrophic destruction. Mandatory immediate containment.
75 – 89	CRITICAL	Unauthenticated agent hijacking with high-privilege tool access or persistent RAG corruption.
60 – 74	HIGH	Tool manipulation or multi-agent propagation capable of unauthorized data mutation or exfiltration.
40 – 59	MODERATE	Supervised tool misuse or bounded data leakage with human oversight barriers.
20 – 39	LOW	Minor prompt steering or behavioral drift without external actuation capabilities.
0 – 19	MINIMAL	Cosmetic text-generation inconsistencies with zero state modification or persistence.

4. Live Benchmark Example: Evaluating CVE-2026-22708

Below is an operational evaluation of CVE-2026-22708 (Cursor IDE Shell Built-in Bypass) using the Hermes ScoreCard component:

HASS

HERMES AGENTIC SECURITY SCORE

Target: Cursor Agent Auto-Run Terminal Tool

Confidence: 95%

91 / 100

EXTREME

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 19 / 20

Tool Access 20 / 20

Privilege 15 / 15

Persistence 12 / 15

External Impact 15 / 15

Propagation 10 / 15

⚖️ Divergence & Operational Rationale

While traditional CVSS rated this flaw as 8.8 (High) due to the local developer context, HASS elevates the score to 91 (EXTREME). The agent's Auto-Run mode executes terminal commands autonomously without user confirmation, weaponizing shell built-ins to poison persistent environment variables and achieve immediate RCE.

5. Confidence Model for HASS

Every HASS score must be accompanied by an explicit Confidence Value (0–100%). Confidence is mathematically calculated based on:

Source Corroboration ($+15%$ per verified independent source)
Technical Proof of Concept Availability ($+25%$)
Reproducibility in Isolated Lab Environment ($+20%$)
Presence of Contradictory Evidence ($-30%$)

Hermes Threat Score (HTS) Methodology Explore how Hermes quantifies real-world operational exploitability and active adversary campaigns.

Confidence Model & Evidence Verification Understand the mathematical models governing fact vs. inference and source verification in Hermes.

Agentic Attack Patterns (AAP) Taxonomy Browse the catalog of structured attack patterns and threat flows mapped to HASS scores.

Rethinking Agent Security as a Networking Problem Foundational research on centralized control planes and sidecar reference monitors.