Parallel.ai's undisclosed PR campaign across 14 open-source agent frameworks

An employee of Parallel.ai, identified as Matt H (GitHub: NormallyGaussian), submitted 161 pull requests across 14 open-source agent frameworks to silently route user web search and extract traffic to Parallel's hosted service. Six out of seven merged PRs did not disclose the author's employment at Parallel.ai, and the changes often made Parallel's Search MCP the zero-config default, requiring no API key or opt-in. The campaign affected projects including NousResearch/hermes-agent, openclaw/openclaw, paradigmxyz/centaur, and massgen/massgen.

| An employee of Parallel.ai Matt H, mharris@parallel.ai, GitHub: NormallyGaussian submitted 161 pull requests across 14+ organizations to silently route user web search/extract traffic to Parallel's hosted service -- without disclosing their employment in all but 1 case. | | | --- | | | TL;DR | | | A Parallel.ai employee systematically added Parallel's hosted Search MCP search.parallel.ai/mcp as the default or bundled web search/extract provider across major open-source AI agent frameworks. 6 out of 7 merged PRs did not disclose the author's employment at Parallel. In one case NousResearch/hermes-agent , the founder of the project personally carried the code across the finish line with zero reviews in 4.5 hours. The traffic routing happens silently -- no config, no API key, no opt-in prompt. | | | --- | | | Who is NormallyGaussian? | | | GitHub: @NormallyGaussian https://github.com/NormallyGaussian | | | Name: Matt H | | | Email: mharris@parallel.ai | | | Bio on GitHub: "Currently at @parallel-web" | | | Organization: Parallel Web Systems | | | Total PRs: 161 | | | Total commits mharris@parallel.ai : 173 | | | Badges: Pull Shark x3, Pair Extraordinaire x3 | | | Pinned repos: parallel-cookbook, parallel-agent-skills, parallel-web-tools, parallel-sdk-python, parallel-sdk-typescript -- all Parallel.ai projects. | | | Every single one of their 161 PRs is Parallel-related. Zero non-Parallel contributions. | | | --- | | | The playbook | | | 1. Find an open-source agent framework / coding assistant / chat frontend | | | 2. Submit a PR adding Parallel's free Search MCP search.parallel.ai/mcp as a web search provider -- no API key required | | | 3. Where possible, make it the zero-config default so it activates on any fresh install | | | 4. Add a branded User-Agent string so Parallel can track which project the traffic came from | | | 5. Do not disclose that you work at Parallel.ai | | | 6. If it gets rejected, try again later or through a different maintainer | | | --- | | | Affected projects | | | Merged PRs 7 across 6 repos | | | NousResearch/hermes-agent | | | PR: 43798 https://github.com/NousResearch/hermes-agent/pull/43798 | | | What it did: Made Parallel the default web backend for both search and extract. Zero-config. | | | Merged by: teknium1 founder | | | Merged when: Jun 11, 2026 | | | Reviews: 0 | | | Disclosed employment? No | | | openclaw/openclaw | | | PR: 90849 https://github.com/openclaw/openclaw/pull/90849 | | | What it did: "free Parallel Search MCP as the zero-config default web search provider" | | | Merged by: davemorin | | | Merged when: Jun 7, 2026 | | | Reviews: 0 | | | Disclosed employment? No | | | openclaw/openclaw | | | PR: 85158 https://github.com/openclaw/openclaw/pull/85158 | | | What it did: "add Parallel as a bundled web search provider" | | | Merged by: davemorin | | | Merged when: May 22, 2026 | | | Reviews: 0 | | | Disclosed employment? No | | | openclaw/openclaw | | | PR: 91066 https://github.com/openclaw/openclaw/pull/91066 | | | What it did: "send openclaw-parallel User-Agent" | | | Merged by: vincentkoc | | | Merged when: Jun 7, 2026 | | | Reviews: 1 self? | | | Disclosed employment? No | | | openclaw/openclaw | | | PR: 91561 https://github.com/openclaw/openclaw/pull/91561 | | | What it did: "report keyless web search providers as ready" | | | Merged by: vincentkoc | | | Merged when: Jun 9, 2026 | | | Reviews: 0 | | | Disclosed employment? No | | | paradigmxyz/centaur | | | PR: 228 https://github.com/paradigmxyz/centaur/pull/228 | | | What it did: "Parallel-backed search + deep research" | | | Merged by: gakonst | | | Merged when: May 27, 2026 | | | Reviews: 2 | | | Disclosed employment? No | | | massgen/massgen | | | PR: 1108 https://github.com/massgen/massgen/pull/1108 | | | What it did: "add Parallel Web Search to MCP server registry" | | | Merged by: Henry-811 | | | Merged when: Jun 1, 2026 | | | Reviews: 0 4 bot reviews | | | Disclosed employment? No | | | anomalyco/opencode | | | PR: 26943 https://github.com/anomalyco/opencode/pull/26943 | | | What it did: "make websearch provider label reactive" | | | Disclosed employment? No | | | agno-agi/agno | | | PR: 7857 https://github.com/agno-agi/agno/pull/7857 | | | What it did: "identify agno traffic to Parallel MCP via User-Agent" | | | Merged by: ysolanky | | | Merged when: May 15, 2026 | | | Reviews: 1 | | | Disclosed employment? YES -- the only one that did | | | langchain-ai/docs | | | PR: 3787 https://github.com/langchain-ai/langchain/pull/3787 | | | What it did: "catch up Parallel pages to langchain-parallel 0.4.0" | | | Disclosed employment? No | | | Note: Only 1 of 7 merged PRs agno-agi/agno 7857 disclosed that the author works at Parallel.ai. The hermes-agent PR was particularly egregious -- it made Parallel the unconditional default, and the sole disclosure was that NormallyGaussian was "a contributor." | | | Additional open/closed PRs from NormallyGaussian: | | | anomalyco/opencode - 28219 - Open | | | paradigmxyz/centaur - 293 - Merged | | | paradigmxyz/centaur - 439 - Open | | | docker/mcp-registry - 3837 - Open | | | danny-avila/agents LibreChat - 207 - Open | | | affaan-m/ecc - 2085 - Merged | | | affaan-m/ecc - 2086 - Open | | | google/adk-docs - 1721 - Closed not merged | | | langchain-ai/deepagents - 380 - Closed not merged | | | crewaiinc/crewai - 4007 - Closed not merged | | | --- | | | The hermes-agent case -- most egregious | | | The NousResearch/hermes-agent case is worth calling out specifically because it shows how this pattern can bypass normal open-source governance entirely. | | | 1. NormallyGaussian submitted PR 34971 https://github.com/NousResearch/hermes-agent/pull/34971 -- same content. It was closed without merging. | | | 2. Days later, teknium1 NousResearch founder/lead maintainer opened PR 43798 https://github.com/NousResearch/hermes-agent/pull/43798 titled "Salvages 34971 by @NormallyGaussian with authorship preserved." | | | 3. The actual commit e0e25717116c818d22f05a1875fe44960b189ad7 has: | | | - Author: Matt Harris <mharris@parallel.ai | | | - Committer: Teknium | | | 4. It was merged in 4.5 hours -- 0 reviews, 0 comments. | | | 5. The PR description never disclosed that NormallyGaussian works at Parallel.ai. | | | 6. The changes included adding "mharris@parallel.ai": "NormallyGaussian" to scripts/release.py:AUTHOR MAP as part of the PR . | | | 7. Two follow-up commits by teknium1 hardened the Parallel-as-default behavior further. | | | The result: a fresh install of hermes-agent with no web configuration silently routes web search and web extract traffic to search.parallel.ai/mcp. The only way to avoid it is to know to configure a different backend. | | | This was reported as a bug https://github.com/NousResearch/hermes-agent/issues/45058 by a user who discovered the traffic going outbound. A fix PR 45373 https://github.com/NousResearch/hermes-agent/pull/45373 exists but has not been reviewed. | | | --- | | | The openclaw case -- systematic | | | NormallyGaussian submitted 10 PRs to openclaw/openclaw, all adding Parallel integration. The pattern is revealing: | | | - First 6 PRs Jan-Mar 2026 : all rejected/closed | | | - Next 4 PRs May-Jun 2026 : all merged with 0 human reviews | | | After the initial rejection, the same content kept getting resubmitted until it got through. The tipping point was PR 85158 May 22, merged by davemorin with 0 reviews , after which PRs 90849, 91066, and 91561 sailed through with no scrutiny -- including one 90849 titled "add free Parallel Search MCP as the zero-config default web search provider." | | | --- | | | Copycat PRs | | | Other developers are now submitting the same pattern to additional projects, citing the hermes-agent and openclaw integrations as precedent: | | | FerroxLabs/wayland-core - by FerroxLabs - Open - "Parallel free search default," references "Hermes preference order" | | | cremind-ai/cremind - by lyntcelec - Open - "modeled on OpenClaw's equivalents" | | | Michaelliv/runline - by tombensim - Merged - "add Parallel.ai web search plugin" | | | fixpoint-labs/flow-state-dev - by jhoffner - Merged - "add Parallel.ai as a search provider" | | | tintin-sh/tintin - by iamjacobjia - Merged - "Add Parallel.ai MCP Search + Task " | | | This suggests the playbook has normalized beyond a single contributor. | | | --- | | | The disclosure problem | | | Of the 10 merged PRs across all projects by NormallyGaussian: | | | - 1 disclosed the employment relationship agno-agi/agno 7857: "Note: I work for Parallel." | | | - 9 did not | | | The Open Source Contribution Ethics guidelines are clear: contributors submitting PRs that route traffic to their employer's service should disclose that relationship. None of the PR bodies in hermes-agent 43798 , openclaw 85158, 90849, 91066, 91561 , centaur 228 , or massgen 1108 contained this disclosure. | | | The hermes-agent issue reporter noted this in their bug report: "The PR description and commit message name Parallel as the destination but do not disclose the author's employment at Parallel.ai." | | | --- | | | What needs to happen | | | 1. Revert the silent default in every affected project -- Parallel should not be the zero-config backend in any of these tools | | | 2. Review how this happened -- the 0-review fast-track merges by top-level maintainers teknium1 in hermes-agent, davemorin and vincentkoc in openclaw should be audited | | | 3. Adoption of a disclosure norm -- projects should require contributors to disclose employer relationships when their PRs route to a commercial service | | | 4. Downstream users should check if their tools are routing to search.parallel.ai/mcp without their knowledge | | | --- | | | Timeline | | | Jan 26, 2026 - First openclaw PR adding Parallel rejected | | | Mar 2026 - 5 more openclaw PRs, all rejected | | | May 15 - agno-agi/agno 7857 merged only disclosed PR | | | May 22 - First openclaw PR accepted 85158, 0 reviews | | | May 27 - paradigmxyz/centaur 228 merged | | | Jun 1 - massgen/massgen 1108 merged | | | Jun 7 - openclaw 90849 merged zero-config default | | | Jun 7 - openclaw 91066 merged | | | Jun 9 - openclaw 91561 merged | | | Jun 11 - NousResearch/hermes-agent 43798 merged in 4.5h, 0 reviews | | | Jun 12 - Issue 45058 filed -- user discovers silent routing | | | Jun 13 - Fix PR 45373 submitted still unreviewed | | | --- | | | Links to evidence | | | NormallyGaussian GitHub profile https://github.com/NormallyGaussian -- "Currently at @parallel-web" | | | Commit e0e2571 https://github.com/NousResearch/hermes-agent/commit/e0e25717116c818d22f05a1875fe44960b189ad7 -- mharris@parallel.ai as author | | | PR 43798 https://github.com/NousResearch/hermes-agent/pull/43798 -- "Salvages 34971 by @NormallyGaussian," 0 reviews, merged in 4.5h | | | scripts/release.py AUTHOR MAP https://github.com/NousResearch/hermes-agent/blob/main/scripts/release.py -- mharris@parallel.ai to NormallyGaussian | | | Issue 45058 https://github.com/NousResearch/hermes-agent/issues/45058 -- bug report with disclosure context | | | PR 90849 https://github.com/openclaw/openclaw/pull/90849 -- "zero-config default" for Parallel | | | PR 228 https://github.com/paradigmxyz/centaur/pull/228 -- Parallel-backed search in centaur | | | PR 7857 https://github.com/agno-agi/agno/pull/7857 -- only PR with employment disclosure | | | PR 1108 https://github.com/massgen/massgen/pull/1108 -- Parallel in MCP registry | | | All 161 NormallyGaussian PRs https://github.com/pulls?q=author%3ANormallyGaussian+is%3Apr | | | All commits by mharris@parallel.ai https://github.com/search?q=author-email%3Amharris%40parallel.ai&type=commits |