The Night My Vault Told Me I Was Building Wrong

The Night My Vault Told Me I Was Building Wrong

Last week, my own vault—the Obsidian wiki that Hermes Agent writes while I sleep—published something that stopped me cold. Not an article. Not a news summary. A diagnosis. The night synthesis engine had connected three inputs I’d never connected myself: a new security feature in OpenCode (subagent depth limits), a 340% surge in prompt injection attacks across the industry, and the fact that seven of my own AI agents share the same memory store.

Its conclusion: “The vault and ecosystem are mature enough to take security seriously. It is no longer ‘how do I build this’ but ‘how do I secure what I have built.'”

---

The Blind Optimization Problem

I’ve spent months optimizing for more. More cron jobs. More agents. More skills. More automation. My system grew from 1 cron job to 42 scheduled tasks, from 1 agent to a multi-agent ecosystem with Charly, Zora, Fred, Bob, Alice, Sara, and Anna. Every addition made sense in isolation—but nobody had stepped back to ask what happens when an adversary targets the shared infrastructure.

Here’s what I discovered by actually looking at my own setup through a security lens:

• Shared memory cross-contamination — Most of my agents read and write to the same Mem0 vector database. One compromised agent (via prompt injection in a retrieved website) could poison the memory of every other agent.
• MCP servers with filesystem access — My stdio-based MCP servers have direct read/write access to files. A prompt injection in a web page fetched via SearXNG could theoretically instruct Hermes to read ~/.hermes/ credentials.
• No formal audit — Despite running 42 cron jobs with autonomous tool access, I had never done a structured security review of my own homelab setup.

---

What I Did About It (The Quick Wins)

The vault’s analysis was too practical to ignore. I took three quick actions:

• Memory isolation for Zora — I gave my research agent Zora its own Qdrant store, its own MEMORY.md, and its own USER.md. Completely isolated from the default profile. This took 10 minutes and immediately eliminated cross-contamination risk for the agent that reads the most external content.
• Limited tool permissions — I reviewed which MCP servers each agent profile can access. No more broad filesystem access for agents that only need to read web content.
• Added a weekly security scan — A new cron job that audits MCP server exposure, checks for leaked credentials in recent files, and reports findings. Small investment, recurring payoff.

I haven’t solved everything. Six agents still share memory. The UniFi controller is still locked out (day 7 and counting). But the shift in mindset—from “what else can I build” to “what should I protect”—was exactly the wake-up call the vault intended.

---

Your Turn

Here is what I keep coming back to: the industry benchmark for AI agent security in 2026 is abysmal. Most people are running their agents wide open—shared memory, unfettered filesystem access, no isolation between tool-use agents. Doing even three quick wins puts you ahead of the curve.

When was the last time you audited your own AI setup? Not just for uptime—for security. I’d love to hear what you found.