Cairn
NousResearch/hermes-agent

Corrupt config triggers silent paid model fallback

Cluster 81952 · hermes cli. Data as of

Nothing open on GitHub. Fix merged in #100156 on 1 Sep 2026. Check it covers your case.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #100156. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #100153. That is separate from the fix event.
Still open
Nothing open on GitHub.

A corrupt config.yaml causes silent fallback to a paid OpenRouter default model and automatic API key ingestion, potentially incurring real charges without operator consent. These members address detection and rejection of corrupt configs in CLI and non-interactive contexts to prevent this behavior.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #100153 fix: fail closed on corrupt config.yaml in non-interactive runs (salvage #81988, extended to gateway/serve/cron)

    merged to main

    files: cron/scheduler.py, gateway/run.py, hermes_cli/config.py, hermes_cli/main.py, tests/hermes_cli/test_config_guard_surfaces.py, tests/hermes_cli/test_noninteractive_config_guard.py

  • #100156 fix(auth): purge silent OpenRouter paid-default adoption (#81952 class fix)

    merged to main

    files: agent/auxiliary_client.py, agent/credential_pool.py, hermes_cli/auth.py, hermes_cli/config.py, tests/agent/test_auxiliary_client.py, tests/agent/test_openrouter_silent_default_purge.py, tests/hermes_cli/test_resolve_provider_corrupt_config.py

1 PR closed without merging

From the close comments: done elsewhere 1

  • #81988 fix(cli): reject corrupt config in noninteractive runs · done elsewhere → #100153
Closed issues · 1
  • Closed#81952Corrupt profile config silently falls back to a paid OpenRouter default model and auto-ingests OPENROUTER_API_KEY — real-money spend without operator consent
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
hermes cli
Merged PRs
#100153, #100156
Closed issues
1
Attempts
1 PR closed without merging
Fix link checked
1 Sep 2026

For your agent

The same facts, typed.

cluster/81952.json
cluster/81952.md