Hermes Agent v2026.5.7: The Tenacity Release — What Changes for the b2b-sdr-agent Skill
Hermes Agent v2026.5.7 ("The Tenacity Release", v0.13.0) shipped on May 7, 2026 — 864 commits, 588 merged PRs, 13 P0 and 36 P1 bug closures since v0.12.0. This is the most operationally significant Hermes release since the interface rewrite. For B2B sales teams running the b2b-sdr-agent skill on top of Hermes, two changes demand immediate action before upgrading.
1. What's New in Hermes v2026.5.7
Multi-Agent Kanban — Durable AI Teamwork
Hermes now ships a production-grade multi-agent Kanban board. Spin up a board, assign tasks, and let multiple Hermes workers pick them up autonomously. The board includes heartbeat monitoring, zombie-process detection, per-task retry budgets, and a hallucination gate that blocks incomplete exits. For B2B teams running parallel outreach pipelines, this is the infrastructure that makes concurrent lead discovery + follow-up + reporting actually safe to automate.
/goal — The Ralph Loop as a First-Class Primitive
The new /goal command locks the agent onto a target across turns. It won't drift. It won't forget. This is the "persistent SDR brief" pattern baked into the core — useful for long qualification sessions that span multiple days.
Checkpoints v2 — Real State Pruning
Session state persistence is rewritten with genuine pruning, not just append-only growth. Long-running SDR sessions that previously bloated checkpoint files will now stay lean. Gateway also auto-resumes interrupted sessions after restart — no lost context when the server reboots.
Cron — Reliability Wave + no_agent Watchdog Mode
Seven critical cron fixes land in v2026.5.7: null next_run_at recovery, parallel state-corruption prevention, MCP server initialization before the cron AIAgent constructs, and more. The new no_agent mode lets operators run script-only watchdog cron jobs without spinning up an agent. For the b2b-sdr-agent's 7 cron schedules, these fixes directly improve reliability.
Security Hardening — 8 P0 Closures
The release closes eight P0 security issues, the most impactful being secret redaction ON by default and WhatsApp stranger rejection by default. Both have direct implications for the SDR skill (detailed in the compat section below).
Google Chat as the 20th Platform
Google Chat joins Hermes as a supported messaging platform, bringing enterprise workspace coverage alongside Slack, Teams, and Discord. Pluggable provider support also ships, making it simpler to swap LLM backends without touching the skill.
2. b2b-sdr-hermes-skill Compatibility Audit
This repo is the SDR skill layer — it is NOT a Hermes fork. Hermes ships; we audit. We do not cherry-pick Hermes core changes.
🔴 BREAKING — WhatsApp Rejects Strangers by Default
Change: PR #21291 closes Hermes security issue #8389. Starting v2026.5.7, WhatsApp will not respond to or initiate contact with unknown numbers unless explicitly opted in.
Impact on b2b-sdr-agent:
SKILL.mdStage 10 (Multi-Channel Orchestration) designates WhatsApp as the primary outbound channel. Cold-lead outreach — the core of any SDR workflow targeting buyers in Russia, Middle East, and Africa — sends first-touch messages to contacts not yet in the operator's phone book.- Without opt-in, those messages are silently dropped. The skill will appear to function normally (cron jobs fire, CRM updates) but WhatsApp outbound to new leads will not deliver.
Fix applied in this repo: SKILL.md updated (setup step 6 + Stage 10) to document the required config:
# In .env or config.yaml — required for cold outreach via WhatsApp
WHATSAPP_ALLOW_STRANGERS=true
Add this before running hermes whatsapp to pair. Without it, the skill automatically falls back to Email as primary for cold leads.
🟡 RELEVANT — Secret Redaction ON by Default
Change: PR #21193. Hermes now redacts secret-shaped strings from all output by default.
Impact: CRM data written to cron output (customer phone numbers, emails, API keys in quotes) may be partially redacted in logs and notifications. The skill's data is not at risk — CRM writes go to your configured backend (Google Sheets / Notion / JSON) before redaction — but owner reports and debug logs will show [REDACTED] for phone numbers and email addresses.
Action: If you need unredacted debug output, add HERMES_REDACT=false to .env. Leave it ON in production — it's a security improvement.
No changes to cron/sdr-schedules.yaml — the cron instruction text is plain natural language, not API calls, so no breakage.
🟢 WATCH — Cron Prompt-Injection Scan on Skill Content
Change: PR #21350. Hermes now scans assembled cron prompts (including injected skill content) for prompt injection patterns.
Impact: The b2b-sdr-agent cron instructions are authored by us and safe. No action needed. But if you have custom cron jobs that interpolate untrusted buyer data into the instruction string, those may now be blocked. Keep instructions static; put dynamic data in the CRM, not the prompt.
3. Recommended User Action: Upgrade with Config Patch
Upgrade now — with one config line.
The WhatsApp breaking change is real but the fix is a single environment variable. Cron reliability improvements and checkpoints v2 are directly valuable for any running SDR skill. Redaction-on-default is a security improvement, not a blocker.
Do not skip this upgrade. The 8 P0 security closures (especially TOCTOU fixes in auth.py and MCP OAuth) protect your credentials and customer data.
4. Install / Upgrade Commands
# Upgrade Hermes Agent
hermes update
# Verify version
hermes --version
# Expected: 0.13.0 (v2026.5.7)
# Install or reinstall the b2b-sdr-agent skill
hermes skills install github:iPythoning/b2b-sdr-hermes-skill
# Or via npx (see SKILL.md for full options)
npx hermes-skill-install b2b-sdr-agent
# After upgrade — add to .env before running hermes whatsapp
echo "WHATSAPP_ALLOW_STRANGERS=true" >> ~/.config/hermes/.env
# Verify cron jobs are intact
hermes cron list
5. Managed Hosting on PulseAgent — No Config Headaches
Running Hermes + the b2b-sdr-agent skill yourself means managing upgrades, .env files, WhatsApp pairing, cron reliability, and credential security — every release. PulseAgent handles all of this for you in a multi-tenant managed environment with automatic skill updates, WhatsApp pairing, and CRM integrations pre-wired.
- Start free on PulseAgent → — SDR skill pre-installed, WhatsApp config included
- View pricing plans →
- AI SDR for B2B Export →
- WhatsApp Sales Automation →
- Multi-Channel Sales Pipeline →
Every new Hermes release is audited against the skill within 24 hours. You never touch a config file.
