Hermes Chat and scan continuation
The Hermes conversation agent, reading saved results, and how an instruction becomes scanner work.
Hermes Chat introduces one conversation agent for the selected Run. It reads the assessment state, explains saved outcomes, and forwards requested follow-up work to Hunt Web. The scan researcher remains responsible for target investigation, with specialists and verification supplied by the same scanning runtime.
The research team itself is described in Blackbox agents.
- Hermes conversation agentOne per selected Run
- Main researcherStarts and coordinates the assessment
- Authorization and business logicauthz-logic
- Server-side injectioninjection-serverside
- Client-side and API behaviorclient-source
- Independent verifierAdded when a candidate is submitted
Read saved results. No scanner agents are started. One Hermes conversation agent answers from saved records.
Reading Previous Results
A request to summarize previous findings, inspect request history, or explain unfinished checks uses the Hermes conversation agent and the saved Run data. It does not start another researcher or specialist wave. If a scan was already running, that existing work continues independently of the read request.
Hermes can read findings, request summaries, recorded test and candidate outcomes, verifier results, and their references. The controller receives the permitted saved-data view, rather than unrestricted access to private response bodies. Large histories are paged, so a partial review must not be presented as a complete assessment of every recorded operation.
An access check is not a scan continuation
Checking current account access is also distinct from continuing a scan. Hermes can request a bounded access check without launching scanner agents. Reading old results remains possible even when a target session has expired; new authenticated tests require usable access.
| Example instruction | Hermes responsibility | Scanner effect |
|---|---|---|
| “Summarize verified findings and unresolved checks from this Run.” | Read saved results and explain the available evidence. | No new scanner activation. |
| “Check whether the saved accounts still have access, without resuming scanning.” | Request a fresh access check and report each account's outcome. | No scanner agents are started; the access check can contact the application. |
| “Continue investigating document permissions using the two saved accounts.” | Forward the instruction to the selected Run and inspect its execution status. | Eligible scanner work starts, resumes, or is queued for the active Run. |
These requests use the same conversation, but ask for different operations. Only the third example requests further security testing.
Continuing an Assessment
For an explicit continuation instruction, Hermes forwards the request to the selected Run. An active scanner can queue that work; an eligible paused Run can resume its saved assessment. The continuation retains the Run's Scope, account bindings, and previous results.
The resulting workflow includes:
- 1One Hermes conversation agentInterprets the instruction, forwards it, and reads its execution status.
- 2One main scan researcherPerforms the requested investigation.
- 3Up to three specialistsWhen delegation applies and capacity is available in that activation.
- 4Independent verifier sessionsFor candidates that reach verification.
- One Hermes conversation agent to interpret the instruction, forward it, and read its execution status.
- One main scan researcher to perform the requested investigation.
- Up to three specialists when delegation is applicable and capacity is available in that activation.
- Independent verifier sessions for candidate submissions that reach verification.
With the full research team, that is five participating agents before verification: one Hermes agent plus four research agents. If one verifier is also active, the illustrative count becomes six. This does not mean six agents always run concurrently: Hermes can finish its reply while the scanner continues, and verification activity depends on submitted evidence.
A focused continuation can use a smaller team
A continuation focused on one existing hypothesis can keep research bounded to that question and suppress the automatic specialist wave. A general continuation can use the wider team when its prerequisites are met. Hermes does not create a separate scanner for every message or independently test the target from the conversation.
The instruction's progress should be read in order: received, queued or starting, scanner working, and then a saved outcome, with a verification stage when applicable. A Hermes acknowledgement establishes receipt, not completed testing. The saved outcome may contain a new Finding, an inconclusive candidate, a negative test, or unfinished work. The scanner can continue after the conversational reply has ended, so the Run's activity and saved results remain the place to assess execution.
- 1ReceivedA Hermes acknowledgement establishes receipt, not completed testing.
- 2Queued or startingAn active scanner queues the work; an eligible paused Run resumes.
- 3Scanner workingThe researcher and specialists investigate.
- 4VerificationWhen candidates are submitted.
- 5Saved outcomeA Finding, an inconclusive candidate, a negative test, or unfinished work.