I report security bugs in AI-agent guardrails, and I keep finding the same shape of bug. This is the first one that's fully public, so I can show you the whole thing — the finding, the fix that shipped, and why I think the design itself is the problem.

The finding (airlock, now public)

airlock is a prompt-injection guardrail in the Hermes plugin catalog. Its job is to stop an agent from doing dangerous things without a human's say-so: in its default approvals_off: block mode, an action that needs approval should be blocked until a person approves it.

The problem I reported: that block could be skipped entirely.

When the Hermes gateway runs a hermes -z turn, the turn is marked unattended in one place ( gateway.session_finite ) but not in the flag airlock was reading ( HERMES_YOLO_MODE ).…