# Nous Research adds an official Security plugin to Hermes Agent for codebase bug review

> Original title: Hermes Agent can now review your codebase for security bugs with the new official Security plugin by @mark_s.

- Source: Nous Research
- Published: 2026-11-08T18:47:00.000Z
- Bad Influence: https://badinfluence.news/items/jmb843wwgl5n9xdlb37a5jcxq
- Original: https://x.com/NousResearch/status/2119501958981857543

## Summary

Nous Research says Hermes Agent can now review a codebase for security bugs through a new official Security plugin. Hermes maps attacker-reachable inputs, splits the code across parallel subagents, and checks whether each candidate finding is exploitable. With test confirmation on, it writes and runs a reproduction for each finding in a temporary repo copy, then exports reports in SARIF format.

## Post

Hermes Agent can now review your codebase for security bugs with the new official Security plugin by @mark_s.

Hermes first maps what an attacker could reach and which inputs it trusts. It splits the code across parallel subagents, checks every candidate finding against the code, and traces whether an attacker can actually exploit it.

Turn on test confirmation and Hermes writes a small reproduction for each finding and runs it in a temporary copy of the repo. Each report records the evidence and the findings Hermes ruled out, and exports to SARIF for your existing tools.

Run it from chat, the CLI, or the Security page in Hermes Desktop.

[Video](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Famplify_video_thumb%2F2119501177792376832%2Fimg%2Fkd1t8r7sAPh7U_Wd.jpg&mode=thumb&exp=1794528000&sig=a601b1e80f09e062)