Cairn

Tool approval enforcement and LLM visibility fixes

NousResearch/hermes-agent · cluster 14806 · agent

Data as of

Nothing open on GitHub. Fix merged in #28323. Check it covers your case.

The short answer

0open issues
0open PRs
6items grouped
Known?
Yes. 6 related items grouped here, 3 issues already closed.
Fix event
A fix was merged to main in PR #28323. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this partially resolved, deciding PR #28323. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and PRs address security gaps where LLM agents could bypass or misinterpret tool-approval states, including timeout handling, silent consent, and making pending-approval status explicitly visible to the LLM.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #28323 fix(approval): surface pending-approval state with explicit marker (#28000)

    merged to main

    files: tools/approval.py, tools/terminal_tool.py

2 PRs closed without merging

From the close comments: closed without comment 1 · merged via another change 1

  • #26579 feat(agent): surface tool-approval pending state to the LLM · closed without comment
  • #28000 fix(approval): surface pending-approval state with explicit marker vi… · merged via another change → 6d495d9, #28323
Closed issues · 3
  • Closed#14806Tool-approval pending state is invisible to the LLM — indistinguishable from "executed + empty result"
  • Closed#40877Bug: approval timeout is interpreted by LLM as system failure, bypassing intended security denial
  • Closed#55999[Bug]: [Security] ask_user return value can be ignored by LLM - enforcement mechanism needed
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.25: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#28323
Closed issues
3
Attempts
2 PRs closed without merging
Fix link checked
19 May 2026

For your agent

The same facts, typed.

cluster/14806.json
cluster/14806.md