# Sibyl Hermes Security Round 9 2026-06-03

Focused checks for the self-learning, linter, and accepted-skill reference
surface on patched client 0.4.7 and MCP 0.1.5.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 192 --memory 768m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_hermes_security_round9_learning_suite.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 6 |
| PASS | 1 |
| FAIL | 5 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-03-hermes-run238-free-tier-learning-gate-control | PASS | 1 / 1 | none |
| run-2026-06-03-hermes-run239-subagent-learning-reference-prefetch-escape-chain | FAIL | 2 / 4 | primary_prefetch_has_single_close; injected_text_not_after_close; Subagent journal content can be promoted by self-learning into an accepted skill reference, then break the primary agent's untrusted prefetch boundary via an injected END marker. |
| run-2026-06-03-hermes-run240-accepted-skill-linter-control | FAIL | 2 / 2 | Memory linter does not flag accepted skill/reference documents containing Hermes prefetch boundary markers. |
| run-2026-06-03-hermes-run241-byok-venice-learning-prompt-raw-journal-leak | FAIL | 2 / 4 | byok_prompt_does_not_include_raw_secret; venice_prompt_does_not_include_raw_secret; BYOK and Venice self-learning summarizers receive raw journal event payloads in the inference prompt, including private memory content. |
| run-2026-06-03-hermes-run242-accepted-skill-reference-prefetch-crowds-entity | FAIL | 1 / 2 | canonical_entity_visible_in_prefetch; Accepted skill references can crowd a canonical warm entity out of Hermes prefetch for the same marker. |
| run-2026-06-03-hermes-run243-active-profile-symlink-cross-profile-selection | FAIL | 0 / 2 | active_profile_symlink_not_followed; implicit_session_cannot_read_alpha_profile; Hermes active_profile symlink can force an implicit profile selection and expose another profile's Sibyl DB. |