# Hermes Agent v0.7.0: pluggable memory providers, credential pool rotation, secret exfiltration blocking

> Memory becomes an extensible plugin interface, multiple API keys per provider can now rotate automatically, and browser URLs plus model responses are scanned for secret patterns. Matters if you run Hermes against rate-limited provider keys or care about prompt-injection exfiltration.

| | |
|---|---|
| **Tool** | Hermes Agent |
| **Version** | v2026.4.3 |
| **Kind** | release |
| **Published** | 2026-04-03 |
| **Observed** | 2026-08-11 |
| **Significance** | 3/5 |
| **Breaking** | no |
| **Categories** | feature, security, fix, api-change |

## What changed


- Memory provider interface: third-party backends (Honcho, vector stores, custom DBs) implement a provider ABC and register through the plugin system; built-in memory stays default, Honcho restored to parity as reference plugin
- Same-provider credential pools with a thread-safe `least_used` strategy; 401 triggers rotation to the next key; pool state survives fallback provider switches and defers eager fallback on 429
- Camoufox anti-detection browser backend with persistent sessions, VNC URL discovery, configurable SSRF bypass for local backends, auto-install via `hermes tools`
- Inline diff previews for file write and patch operations in the tool activity feed
- API server streams tool progress events and accepts `X-Hermes-Session-Id` for sessions persisted to the shared SessionDB
- ACP: editors (VS Code, Zed, JetBrains) can register their own MCP servers, surfaced as agent tools
- Gateway hardening across race conditions, photo media delivery, flood control, stuck sessions, approval routing, and compression death spirals
- Security: secret-pattern scanning of browser URLs and model responses (URL-encoded, base64, prompt-injection paths); credential directory protection extended to `.docker`, `.azure`, `.config/gh`; execute_code sandbox output redacted
- Provider details: `developer` role for GPT-5 and Codex models, Anthropic long-context 429 handling drops context to 200k, Fireworks context-length detection, DashScope international endpoint, MiniMax bearer auth
- Scope: 168 PRs, 46 resolved issues


## Sources

- [github_release](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.4.3) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/hermes-agent/v2026-4-3
Entity: https://changelogs.info/hermes-agent
Event ID: `evt_2026-04-03_hermes-agent_v2026-4-3`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.