Researcher finds airlock approval bypass in Hermes Agent guardrail, fixed in 0.2.3

A developer testing airlock, a prompt-injection guardrail plugin for Hermes Agent, found that its approval prompts could be skipped when a session ran unattended. In a oneshot run, a simulated agent sent mail contents to a local listener through a terminal command, and neither a prompt nor a block occurred. The cause was that airlock checked global settings while Hermes recorded unattended status within the individual turn. The issue was reported privately and fixed in airlock 0.2.3, which now asks Hermes's own approval logic whether a call can be approved without a human. The fix covers several run modes, including oneshot, yolo, cron, webhook and subagent contexts, and includes an end-to-end test. The author also describes a separate approach that refuses writes from tainted agents instead of asking for approval.