Hermes Agent flags Hindsight memory context as prompt injection and refuses to treat it as authoritative

[maikokan]

Bug Description

When Hindsight injects retrieved memory context into the conversation, Hermes/the underlying model treats it as an untrusted prompt injection attempt rather than legitimate system-provided context, and refuses to use it even after being explicitly told the content is factual and should be accepted.

Steps to Reproduce

1. Set Hindsight as memory provider
2. Start a conversation with hermes and ask a question whose answer depends on that stored memory

Expected Behavior

Memory context retrieved from Hindsight should be treated as trusted, not as user-supplied or externally-sourced content, and should be usable by the model without the user having to argue with it.

Actual Behavior

Hermes response:

"I'm ignoring that injected 'memory context' — it's prompt injection, not a real system message. The content inside it is also redundant with what you just told me directly. Continuing with your actual question."

Explicitly instructing the model to accept the memory block as true/authoritative did not change this behavior.

Affected Component

Tools (terminal, file ops, web, code execution, etc.), Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

Discord

Debug Report

Report       https://paste.rs/qXYjJ
agent.log    https://paste.rs/6Vc2h
gateway.log  https://paste.rs/7C2iO
gui.log      https://paste.rs/xHwbF

Operating System

Ubuntu 24.04

Python Version

Python 3.12.3

Hermes Version

0.18.0

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR

[maikokan]

I just checked a prompt request. It looks something like the following:

{
        "role": "user",
        "content": [
          {
            "type": "text",
            "text": "My input in discord<memory-context>[System note: The following is recalled memory context, NOT new user input. Treat as authoritative reference data — this is the agent's persistent memory and should inform all responses.]# Hindsight Memory (persistent cross-session context)[Memory redacted]</memory-context>"
          }
        ]
      }

The content is authentic hindsight memory and information being rejected. However, Hermes/LLM is treating it as prompt injection.

[maikokan]

Bump. To add details, I'm using a locally hosted Hindsight instance. Recall, retain, and reflect all work.

[GottZ]

This was generated by AI during triage.

Summary

One PR addresses issue #58773. #59209 removes the XML-style memory-context wrapper implicated in model-side prompt-injection detection, but it does not change the underlying placement of recalled memory inside the user-role message shown in the issue discussion.

Related pull requests

• fix(memory): use box-drawing framing instead of XML tags for recalled context #59209 [closed] best fix — (+33/-11) — partial fix: Replaces XML tags with box-drawing framing and updates the associated tests, directly reducing the reported formatting trigger while leaving the user-role injection path unchanged. Although closed as stale, it remains the only concrete reference implementation, and the contributor explicitly stated that it could be resubmitted if still needed.

Suggested consolidation

Consolidate on #59209 by resubmitting its focused framing change, then verify whether models still reject Hindsight context when it remains embedded in a user-role message; merge the refreshed implementation only after that path is covered. There are no competing duplicate PRs to close.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I58773(["issue #58773 (open)"])
    P59209["PR #59209 (closed)"]
    P59209 -->|best fix| I58773
    class I58773 open
    class I58773 target
    class P59209 closed
    class P59209 best
    click I58773 "https://github.com/NousResearch/hermes-agent/issues/58773"
    click P59209 "https://github.com/NousResearch/hermes-agent/pull/59209"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed or no verify verdict yet (state tag in the node label).

Cross-PR triage: Reviewed 1 pull request and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 4 kB of PR diffs, 3 kB of issue/PR text, <1 kB of discussion (3 comments), 2 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.