From f3b79200ff9958a341f9decfc901e322ee29da41 Mon Sep 17 00:00:00 2001 From: liuhao1024 Date: Sat, 30 May 2026 13:12:58 +0800 Subject: [PATCH] fix(batch): set HERMES_CRON_SESSION to enforce approval guards When batch_runner.py processes dataset prompts, it creates AIAgent instances without setting any of the interactive environment variables (HERMES_INTERACTIVE, HERMES_GATEWAY_SESSION, HERMES_EXEC_ASK). This causes the dangerous command approval system to auto-approve all flagged commands, allowing prompt injection payloads in untrusted datasets to achieve arbitrary command execution. Fix: set HERMES_CRON_SESSION=1 via os.environ.setdefault() before creating AIAgent instances, so the approval system enforces the cron-style deny-by-default policy. Fixes #35164 --- batch_runner.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/batch_runner.py b/batch_runner.py index 28936198955..04ad81d28ca 100644 --- a/batch_runner.py +++ b/batch_runner.py @@ -314,6 +314,15 @@ def _process_single_prompt( print(f" Prompt {prompt_index}: Using container image {container_image}") try: + # Mark this process as a non-interactive batch session so the + # dangerous-command approval system (tools/approval.py) enforces + # the cron-style deny-by-default policy instead of auto-approving + # every command. Without this, batch_runner.py would bypass all + # safety checks because none of HERMES_INTERACTIVE, + # HERMES_GATEWAY_SESSION, or HERMES_EXEC_ASK are set. + # See: https://github.com/NousResearch/hermes-agent/issues/35164 + os.environ.setdefault("HERMES_CRON_SESSION", "1") + # Sample toolsets from distribution for this prompt selected_toolsets = sample_toolsets_from_distribution(config["distribution"])