Running an AI agent inside a Docker sandbox has always carried a quiet risk: your real API keys sit inside that container. A single prompt injection, a compromised dependency, or a rogue tool call is all it takes for an attacker to run printenv | grep -i key and walk away with credentials that work anywhere on the internet. Nous Research's new iron-proxy egress feature for Hermes Agent closes that gap.
The problem it solves
Prompt injection -- where malicious content in a webpage or file tricks an agent into running unintended commands -- is one of the most realistic attack vectors against agentic systems today. When Hermes runs an agent inside a Docker terminal sandbox, that sandbox normally holds real upstream API keys like OPENROUTER_API_KEY and OPENAI_API_KEY. A compromised sandbox can trivially read those keys and exfiltrate them. The keys then work from anywhere -- the attacker's machine, a cloud instance, anywhere.
Every AI agent that does something useful needs credentials: API keys, access tokens, wallet keys, RPC endpoints. The more capable the agent, the more sensitive the credentials it holds. Most frameworks treat this as the developer's problem. Hermes is now treating it as infrastructure.
How the firewall actually works
The egress proxy fixes this: the sandbox holds opaque proxy tokens, never the real keys. All outbound traffic from the sandbox routes through a local iron-proxy daemon on the host, which terminates TLS and swaps the proxy token for the real credential before forwarding the request upstream. The real key never crosses the container boundary.
The flow looks like this:
- The sandbox makes an HTTPS request to, say,
openrouter.ai
Don't miss what's next in AI
Join 300,000+ engineers and researchers who get the signal, not the noise.
- Full access to in-depth AI research breakdowns
- Be the first to know what's trending before it hits mainstream
- Daily curated papers, repos, and industry moves