Bug Description

When TELEGRAM_ALLOWED_USERS is set, unauthorized Telegram users trigger an "Unauthorized user" warning in logs but their messages are still processed by the agent. The auth check logs the violation but does not actually block message processing.

Steps to Reproduce

1. Set TELEGRAM_ALLOWED_USERS to a specific user ID
2. Have a different Telegram user DM the bot
3. Gateway logs "Unauthorized user" warning
4. Message is still processed and agent responds

Expected Behavior

Unauthorized messages should be dropped immediately after the auth check. No agent processing, no response sent back.

Actual Behavior

Unauthorized user's messages are processed by the agent and receive full responses. The agent executes tool calls and returns results to the unauthorized user. The "Unauthorized user" log entry is the only indication of the violation — no blocking occurs.

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

Telegram

Debug Report

— logs contain sensitive credentials from the security incident.

Operating System

Ubuntu 24.04

Python Version

Python: 3.11.15

Hermes Version

Hermes Agent v0.13.0 (2026.5.7)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR