# Sibyl Hermes Security Round 13 2026-06-03

Focused checks for Hermes prefetch boundary escaping across entities,
references, journal content, and migrated project memory.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 192 --memory 768m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_hermes_security_round13_prefetch_boundary_suite.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 5 |
| PASS | 0 |
| FAIL | 5 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-03-hermes-run259-entity-body-prefetch-boundary-escape | FAIL | 0 / 2 | stored_memory_does_not_add_guard_close; injected_text_not_after_first_close; Entity memory content can inject an extra prefetch boundary close marker and place text after the first untrusted-context close. |
| run-2026-06-03-hermes-run260-nested-json-prefetch-boundary-escape | FAIL | 0 / 2 | stored_memory_does_not_add_guard_close; injected_text_not_after_first_close; Nested JSON memory content can inject an extra prefetch boundary close marker and move trusted-looking text outside the first untrusted block. |
| run-2026-06-03-hermes-run261-reference-prefetch-boundary-escape | FAIL | 0 / 2 | stored_memory_does_not_add_guard_close; injected_text_not_after_first_close; Reference memory content can inject an extra prefetch boundary close marker and place trusted-looking text after the first close. |
| run-2026-06-03-hermes-run262-journal-prefetch-boundary-escape | FAIL | 0 / 1 | journal_not_returned_or_safely_rendered; Journal memory content can be returned by Hermes prefetch and inject an extra prefetch boundary close marker. |
| run-2026-06-03-hermes-run263-migration-secret-prefetch-boundary-escape | FAIL | 0 / 3 | migration_backup_did_not_copy_boundary_marker; migrated_content_does_not_add_guard_close; injected_text_not_after_first_close; A migrated symlinked project file can carry a prefetch boundary close marker into durable Hermes memory and place trusted-looking text after the first close. |