Hermes (or any agent) reads your mail, web pages, and DMs.
It has no way to tell your instructions apart from a stranger's, because to the model they're both text in the same window. That's prompt injection, no exploit required.
What you can control is what gets in.
