Nous Research has introduced an official Security plugin for Hermes Agent, expanding the capabilities of its artificial intelligence platform with automated code security reviews.
The new plugin, called hermes-security, is designed to help developers identify vulnerabilities, investigate potential attack paths and improve software security through AI-powered analysis.
The announcement, published on November 8, 2026, represents another step in the development of autonomous AI agents capable of handling increasingly complex software engineering tasks.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Rather than simply generating code or assisting with debugging, Hermes Agent can now examine entire codebases for security weaknesses and provide evidence supporting its findings.
The plugin approaches security reviews by first building a threat model of the repository. It identifies which parts of the application an attacker could potentially access and determines which inputs the software trusts.
This allows the agent to focus its investigation on areas where vulnerabilities could create meaningful security risks. After establishing the threat model.
Hermes divides the codebase into smaller sections and distributes the review among multiple parallel AI subagents. These agents examine different portions of the repository, investigate suspicious code and evaluate possible vulnerabilities.
The system subsequently checks candidate findings against the actual code and traces whether an attacker could realistically exploit them. This approach is important because automated security tools frequently generate false positives.
A suspicious coding pattern does not necessarily represent an exploitable vulnerability. By examining accessibility, trust boundaries and potential attack paths.
Hermes aims to distinguish genuine security problems from issues that appear dangerous but cannot realistically be exploited. Another significant feature is optional test confirmation.
When enabled, Hermes can write small reproductions of suspected vulnerabilities and execute them in a temporary copy of the repository. This provides additional evidence that a reported weakness can actually be triggered.
However, developers should understand that this temporary environment is not a security sandbox, since repository code still executes with the user’s privileges.
The plugin produces detailed reports containing supporting evidence, rejected findings and information about the code examined. Reports can be exported in Markdown, JSON, CSV and SARIF formats, allowing developers to incorporate the results into existing security workflows.
Users can access the functionality through Hermes Agent’s chat interface, command-line interface or a dedicated Security page in Hermes Desktop.
The plugin supports standard, deep and differential scanning modes, giving developers flexibility depending on whether they want to examine an entire repository or concentrate on recent changes.
Installation requires Hermes version 0.21.5 or later and Python 3.11 or later. Developers can install it using the command “hermes plugins install hermes-security –enable” and restart the agent.
The release comes with important considerations. Source code reviewed by the agent is transmitted to the configured model provider, while dependency information may be shared with external vulnerability databases.
Organizations handling confidential software must therefore evaluate their data-sharing requirements before enabling the feature. Nous Research’s latest release highlights the growing convergence between autonomous AI agents and cybersecurity.
As AI-generated software becomes more widespread, identifying vulnerabilities before deployment will become increasingly important. Hermes Security offers developers another layer of automated protection, although human oversight and established security testing remain essential.