{
  "id": 3079891,
  "title": "Grok Bot vs. Hermes: Where each draws the security boundary",
  "url": "https://urgent.news/2026/08/24/grok-bot-vs-hermes-where-each-draws-the-security-boundary",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T17:39:15.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/ai-agent-security-boundaries/"
  },
  "original_language": "en",
  "account": "Two AI bot releases this month tackle the challenge of security boundaries for multi-bot environments. Nous Research's Hermes Agent v0.20.3 features Bot Mode, enabling named bots to hand off tasks among themselves. SpaceXAI introduced Grok Bot with a sidebar of named teammates that maintain sessions across logged-out sessions. The key question each product must answer is: when one bot misbehaves, what can it reach?\n\nGrok Bot's security boundary is the user account. SpaceXAI describes bots as having their own computer, but only the user account is isolated. Browser cookies, shared files, and command-line credentials allow bots to access each other's work. Each bot receives its own screen on the shared machine, allowing parallel execution of browser and desktop tools. However, this shared workspace is not a security boundary, as it sits at /workspace and survives computer updates and recovery. Signing in for one bot makes that session available to others, and installed connectors are account-wide.\n\nIn contrast, Hermes draws the boundary around the profile. Each bot is a profile with its own configuration, memory, skills, credentials, and chat history stored in its own directory. Handoffs between bots are real invocations against the named profile, not a shared context blob. Hermes documents workstation-level separation of agent state, which is stronger than the shared cloud account but not the same as isolation. The sandbox mode is off by default, and if setup fails, the script defaults to running without sandbox isolation. Despite these shortcomings, Hermes offers the most complete boundary among the four projects.\n\nOpenClaw's approach is centered around an optional runtime sandbox. When enabled with the Docker backend, agent tool execution runs inside isolated containers. Auth material resides per agent under an agent-scoped auth profiles file. Network isolation, resource limits, and tool policies can be configured at various scopes, including per-agent, per-session, or shared across agents. However, the default for sandbox mode is off, and failing to mount the host Docker socket into agent sandbox containers could lead to running without sandbox isolation. OpenClaw also warns against mounting the host Docker socket and flags the CLI container's shared network namespace.",
  "summary": "Put several AI bots to work, and a mistake by one may not stay within its assigned task. For example, The post Grok Bot vs. Hermes: Where each draws the security boundary appeared first on The New Stack .",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}