Hermes Agent fixes desktop media stream credential leak
Teknium · x · 2026-08-17
NousResearch's Hermes Agent project merged a PR to fix an authentication vulnerability in desktop remote media streaming.
Root Cause: <audio>/<video> elements cannot send Bearer headers or cookies, causing playback failures in OAuth mode or leaking session tokens via ?token= URL parameters visible to renderer state and logs.
Fix: Introduced a remote/ target for the hermes-media:// protocol. The renderer requests a credential-free URL, while the Electron main process handles streaming and authentication, ensuring no credentials are exposed to the renderer layer.
More from coding & agent
- Obscure Performance Fix Cuts CPU Usage by 80% — DanielLockyer · 2026-08-17
- Switching to direct DB connections cut P95 latency from 480ms to 80ms — DanielLockyer · 2026-08-17
- OpenAI embraces x402 for agent commerce; author flags whitelist scalability issue — MountainAssignment36 · 2026-08-17
- Wasting 2M context? Google's guide suggests a different structure for Gemini — thisdudelikesAI · 2026-08-17
- Luna Subagents Could Verify Game Wikis, Codex Reads Codebases — Angaisb_ · 2026-08-17
- Writing C code manually with AI autocomplete beats AI generation — tetsuoai · 2026-08-17