Hermes Agent routing flaw silently hijacks models to metered OpenRouter, costing users money
WolframRvnwlf · x · 2026-09-10
A user PSA reports a dangerous provider-routing flaw in Nous Research's open-source Hermes Agent (present in v0.21.0 and stable v0.21.1) that cost him $100. Running /model gpt-6-astra in an OpenAI Codex thread unexpectedly switches the request to metered OpenRouter. Root cause: detectproviderformodel only consults the static PROVIDERMODELS catalog and silently falls back to an OpenRouter slug whenever a model's bare name exists there, even if the current provider already serves it. PR #97487 fixes this by checking the current provider's live catalog before any OpenRouter fallback; the author tags Teknium for review.
Related event: Hermes Agent routing flaw silently hijacks billing to OpenRouter(2 posts)→
More from coding & agent
- DeepSeek releases Harness v0.1.5 with Agent Teams, co-trained with V4.1 Flash — teortaxesTex · 2026-09-10
- Peated cuts scraper backlog under 10k, uses Codex plus a playbook to clean bottle listings on a budget — zeeg · 2026-09-10
- iCoder-27B: An AI Agent Autonomously Built a 27B Coding Model at SJTU, DP Technology & NUS — jiqizhixin · 2026-09-10
- Dev: MCP plus OAuth 2.1 unlocks agents, the old permissioned OAuth 2 world was holding them back — dosco · 2026-09-10
- AI assistant Muse ships IDENTITY.md, SOUL.md and MEMORY.md, echoing openclaw — steren · 2026-09-10
- Hidden Test Suites for Coding Agents: Stopping the Agent From Gaming the Evaluator — fromkrish · 2026-09-10