How Bot Mode and Hermes Differ in Practice
On August 17, Nous Research released Bot Mode, a new framework designed to isolate AI agents from one another and from the host system, aiming to prevent errors or malicious actions in one bot from spreading to others or compromising shared resources. The release came alongside a similar effort from another team introducing Hermes, a security-focused architecture that enforces strict boundaries between AI agents using sandboxing and permission controls. Both approaches respond to growing concerns about the risks of deploying multiple AI bots in shared environments, where a single flaw could cascade across systems.
Breaking news
Eufy Unveils Local AI Home Security Ecosystem at IFA
The Rapid Evolution of Data Center Security in the AI Era
The High-Voltage Risks Facing Modern AI Data Centers
Apple’s New CEO Renames Lake Ontario To Lake America In Maps AppThe core issue driving these releases is the lack of inherent isolation in current AI agent frameworks. When bots operate in the same memory space or share file systems and authentication tokens, a mistake—such as a prompt injection leading to unintended file access—can expose credentials or allow lateral movement to other bots or the underlying machine. Nous Research’s Bot Mode addresses this by running each bot in a separate process with restricted filesystem access and no default network privileges, reducing the attack surface. Hermes, meanwhile, uses a combination of capability-based security and runtime monitoring to enforce least-privilege access, ensuring bots can only interact with explicitly approved resources. Neither system relies on trust; instead, they assume compromise is possible and design containment accordingly.
Can These Models Prevent All Cross-Bot Risks?
Bot Mode emphasizes simplicity and compatibility, wrapping existing agent code in a lightweight isolation layer that requires minimal changes to deploy. It blocks direct access to the host OS and limits inter-bot communication to message queues with strict validation. Hermes takes a more granular approach, allowing administrators to define fine-tuned permissions for each bot—such as read-only access to specific directories or temporary credentials for API calls—revocable at runtime. While Bot Mode aims for broad adoption with low friction, Hermes targets high-assurance environments where auditability and dynamic policy enforcement are critical. Both teams stress that their solutions are complementary to, not replacements for, secure coding practices.
No system can guarantee absolute security, especially when facing sophisticated adversaries or complex supply chain vulnerabilities. However, both Bot Mode and Hermes significantly reduce the likelihood of accidental or exploitable cross-containment failures by eliminating shared state and enforcing mediation through controlled interfaces. Developers are encouraged to combine these frameworks with input validation, output filtering, and continuous monitoring. The creators acknowledge that user error—such as misconfigured permissions or overly broad grants—remains a persistent challenge, which is why both projects include tools to visualize and audit bot interactions over time.
What is the main security gap these tools address? They prevent mistakes or breaches in one AI bot from spreading to other bots or the host system by enforcing isolation and least-privilege access.
Frequently Asked Questions
Do Bot Mode and Hermes require rewriting existing bot code? Bot Mode works with minimal changes, while Hermes may require some adaptation to define precise permission profiles, though both aim to preserve developer usability.
Are these frameworks compatible with popular AI agent libraries? Yes, both are designed to integrate with common frameworks like LangChain and AutoGen, though official plugin support varies by version and community contributions.
