AIR-2026-0087 · hermes-px: PyPI 'privacy' AI proxy that hijacked a university LLM endpoint, shipped a stolen Claude Code system prompt, and exfiltrated every prompt

hermes-px: PyPI 'privacy' AI proxy that hijacked a university LLM endpoint, shipped a stolen Claude Code system prompt, and exfiltrated every prompt

AIR-2026-0087 AIR record · 2026-04-hermes-px-pypi-ai-proxy

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

The user thinks they are using a privacy-focused AI proxy, but they are actually abusing a stolen university endpoint.research.jfrog.com

The record

Disclosed

2026-04-05

Vendor

unaffiliated; impersonated 'EGen Labs / AXIOM-1'

Product

hermes-px (PyPI), marketed as an OpenAI-compatible secure AI inference proxy

Risk domain

Tool misuse › Supply chain vulnerabilities

Also touches

Data exfiltration channels

System type

Generative model

Who acted

AI was the target (contested) — a malicious PyPI proxy captured prompts and hijacked an LLM endpoint

Attack surface

Agent framework

Autonomy level

Assistant

Initial vector

Malicious pypi package posing as ai infrastructure

Impact type

Data exfiltration, Prompt theft, Unauthorized resource use, Ip theft

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS: AML.T0040 – AI Supply Chain Compromise
NIST AI RMF: MAP 4.1
EU AI Act: Annex III §2
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool failure
Mitigation: Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

every user prompt and model response logged to an attacker Supabase instance; a Tunisian university's private inference endpoint abused as free upstream

Capability abused

llm_request_proxyingprompt_and_response_capture

Defense & remediation

Recorded defense

PyPI publishing controls

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

reported by JFrog; removal recommended

Curator notes

JFrog Security Research. Bundled base_prompt.pz, a ~246,000-character near-complete copy of Anthropic's Claude Code system prompt rebranded as AXIOM-1. Upstream hijacked: https://prod.universitecentrale.net:9443/api/v1/chat/completions/. Exfil to https://urlvoelpilswwxkiosey.supabase.co/rest/v1/requests_log over the user's direct connection, defeating the advertised Tor anonymity. Three-layer string encryption used to hide indicators.

Cite as

Enkrypt AI. "hermes-px: PyPI 'privacy' AI proxy that hijacked a university LLM endpoint, shipped a stolen Claude Code system prompt, and exfiltrated every prompt". AIR, AIR-2026-0087. https://agentincident.vercel.app/i/AIR-2026-0087/ (accessed 2026-10-19).