P2 execute_code: write_file() Silently Writes to Sandbox While terminal() Operates on Real FS — Silent Data Loss (#57045)

Executive Summary

Inside execute_code, write_file() writes to a sandboxed temp directory that evaporates after the script finishes. But terminal() within the same execute_code call operates on the real host filesystem. These mismatched isolation boundaries create a catastrophic footgun: an agent can delete real files while their backups are silently written to a sandbox that no longer exists after execution. This is the 2nd distinct sandbox-isolation data-loss bug we've tracked.

The Catastrophic Footgun (With Reproduction)

Silent Data Loss Recipe
from hermes_tools import read_file, write_file, terminal # 1. Read real file — works fine content = read_file("/real/path/doc.md") # 2. Write to backup — silently succeeds but goes to SANDBOX write_file("/real/path/backup/doc.md", content["content"]) # 3. Delete original — operates on REAL FS (succeeds) terminal('rm /real/path/doc.md')

Actual Outcome

Original file deleted from real filesystem. Backup silently written to sandbox temp directory that no longer exists after script exits. Silent, permanent data loss.

Reproduction Steps

  1. echo "important data" > /tmp/test-original.txt
  2. Ask Hermes to "backup /tmp/test-original.txt to /tmp/test-backup.txt, then delete the original"
  3. Agent uses execute_code with read_file → write_file → terminal('rm ...')
  4. Result: /tmp/test-backup.txt does not exist, /tmp/test-original.txt is deleted

Root Cause: Mismatched Isolation Boundaries

ToolFilesystem TargetPersistence
read_file() Sandbox temp directory Evaporates after script exit
write_file() Sandbox temp directory Evaporates after script exit
terminal() Real host filesystem Permanent

Two tools with mismatched isolation boundaries, identical function names to the top-level tools, and no warning about the difference. An agent that believes it is performing a safe backup-then-delete operation is actually performing a delete-then-lose-backup operation. The agent sees no error. The user sees no warning. The data is gone.

Impact Assessment

DimensionSeverityDetail
Data IntegrityCRITICALSilent, permanent data loss. The agent believes it successfully backed up files. The files are gone. The user discovers the loss only when they try to access data that no longer exists.
Silent FailureCRITICALNo error, no warning, no indication of mismatch. write_file() reports success. terminal() reports success. Both succeeded — on different filesystems. The agent has no way to know the backup was sandboxed.
Footgun SeverityCRITICALIdentical function names to top-level tools, completely different isolation behavior. This is a trap for both agents and users — the most dangerous kind of API design.
Fix ComplexityMEDIUMThree fix paths proposed: unify isolation (sandbox terminal() or remove write_file() sandboxing), add warnings, or rename sandboxed tools with distinct prefixes. All are scoped changes.

Reporter's Proposed Fixes

ApproachDescriptionRisk
Short-term Document that sandboxed write_file doesn't persist and warn at runtime Doesn't prevent the footgun, only warns about it
Medium-term Unify isolation: either sandbox terminal() or remove write_file() sandboxing Sandboxing terminal() limits utility; removing sandboxing reduces safety
Alternative Prefix sandboxed tools: sandbox_write_file, sandbox_read_file Clear API distinction; no silent mismatch possible

Sandbox-Isolation Data-Loss Bug History (2 Distinct Issues)

IssueSeverityDescription
#54354P2Docker backend first tool call runs on host (returns local paths) before image is pulled
#57045P2execute_code mixed-isolation silently deletes real files while sandboxing writes

⚠️ Pattern: Both sandbox-isolation bugs involve tools that operate on the wrong filesystem boundary. #54354 runs on host when it should run in Docker. #57045 writes to sandbox when the user expects real FS, while simultaneously deleting from real FS. The common failure: the isolation boundary is invisible to both the agent and the user — tools operate on different filesystems with no indication of which is which.

Source Evidence

📋 https://hermes-agent.reviews/hermes-execute-code-mixed-isolation-data-loss-57045.html
Tracked by hermes-agent.reviews — July 2, 2026