Hermes Agent adds a Security plugin that tests its own findings

Hermes Agent added an official Security plugin, built by Mark S., that reviews your codebase for security bugs.

It starts by mapping what an attacker could reach and which inputs the code trusts, then splits the work across parallel subagents. It checks each candidate finding against the code to see whether an attacker can actually exploit it.

Turn on test confirmation and Hermes writes a small reproduction for each finding and runs it in a temporary copy of the repo. Each report keeps the evidence and the findings it ruled out, and exports to SARIF so they drop into the security tools you already use.

You can run it from chat, the CLI, or the Security page in Hermes Desktop. Install it with hermes plugins install hermes-security.