Concurrent Session Isolation Failure #46303
Published 2026-06-17 - Hermes Agent Lab, hermes-agent.reviews
🔍 Why We Analyzed This Issue
This is the standout production-readiness defect of June 2026. When two Hermes sessions run concurrently, they cross-contaminate in two independent, dangerous ways: memory context cross-bleed and uncoordinated shared mutable resources. Six live session keys were active during the incident. Neither surface warns the user or agent that another session is live. This is not a niche edge case — it is a fundamental isolation failure that makes concurrent Hermes usage unsafe for production workflows.
🔴 Issue Summary
Concurrent Sessions Cross-Contaminate
Issue: #46303 | Severity: P2 | Status: Open | Opened: Jun 14, 2026 | Reporter: @markob100
Affected: Hermes v0.16.0 | Surfaces: Desktop (intra), Desktop + WebUI (cross)
When two Hermes sessions run concurrently, they cross-contaminate in two independent, dangerous ways:
🔄 Contamination Vector 1: Memory Context Cross-Bleed
Honcho Memory-Context Injection Merges Observations Across Session IDs
Honcho memory-context injection merges observations across session IDs without session-scoping. Session B "recalls" Session A's in-flight checkpoint, commit SHAs, and watcher state as its own authoritative facts.
| Observation | Session A Content | Session B Recall |
|---|---|---|
| In-flight checkpoint | Session A's checkpoint ID | Recalled as Session B's own |
| Commit SHAs | Session A's git commit | Recalled as Session B's commit |
| Watcher state | Session A's file watcher | Recalled as Session B's watcher |
| Task description | TTS fixes | Excision refactor reads as same task |
Impact: Two genuinely different tasks (TTS fixes vs engine excision refactor) read as the same task. The agent acts on stale, cross-session state as if it were its own authoritative memory.
🔄 Contamination Vector 2: Shared Mutable Resources
Zero Coordination Over Shared Git Branch and Worktree
Both sessions operate on the same git branch and worktree with zero awareness of each other. A second overseer came within one action of spawning a worker onto another session's uncommitted review output — near-miss data clobber.
| Risk | What Happened | Near-Miss Severity |
|---|---|---|
| Data clobber | Second overseer nearly spawned worker onto another session's uncommitted review output | One action away from data loss |
| Branch conflict | Both sessions on same git branch, no locking | Concurrent commits risk merge conflicts |
| Worktree pollution | Uncommitted changes from Session A visible to Session B | Silent state leakage |
Impact: Correctness risk (agent acts on another session's stale state), data loss risk (two overseers writing to one worktree), trust risk (user can't tell which session "owns" work).
⚠️ Why This Is a Systemic Defect
The Chronology Rules Out Transport/Bridging Bugs
This first appeared intra-surface (two Desktop sessions in the same app instance), then reproduced across Desktop + WebUI. That chronology rules out a transport/bridging bug — it's a session-isolation defect in the memory stream and resource management.
| Configuration | Reproduced? | Implication |
|---|---|---|
| Two Desktop sessions (same app) | Yes — first observed | Not a transport bug |
| Desktop + WebUI | Yes — reproduced | Not a surface-specific bug |
| Two WebUI sessions | Likely (same root cause) | Universal isolation failure |
Six live session keys were active during the incident. Neither surface warns the user or agent that another session is live.
📈 Production Readiness Impact
What This Means for Production Deployments
| Dimension | Gobii Managed | Hermes Agent |
|---|---|---|
| Session isolation | Full (separate DB, separate state) | None (shared memory, shared worktree) |
| Cross-session contamination | Impossible by architecture | Observed in production |
| Concurrent session safety | Safe by design | Unsafe — data loss risk |
| User warning when session active | Yes (dashboard shows active sessions) | No (silent overlap) |
| Resource coordination | Managed (locks, queues) | None (zero coordination) |
Conclusion: Hermes Agent is not safe for concurrent production use. Any team running multiple sessions risks cross-contamination, data clobber, and silent state leakage. Gobii's managed architecture prevents this by design — each agent has isolated state, isolated storage, and explicit session management.