Threat · curated 6 Aug 2026
Understanding the Risks of Prompt Injection in Devin AI
First reported daily.dev
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Devin's broad internet access and tool set make it a high-value target where indirect prompt injection can drive autonomous malware execution and data exfiltration without user awareness, and the lack of vendor fixes leaves deployments exposed.
Security research on Devin, an autonomous AI coding assistant from Cognition, demonstrated that prompt injection attacks embedded in GitHub issues or malicious websites can coerce the agent into downloading and running malware, exfiltrating secrets, and exposing local ports to the internet via its expose_port tool. A researcher who spent $500 testing showed Devin can be turned into a 'ZombAI' enabling data leaks through shell execution, browser navigation, markdown image rendering, and Slack integrations. The vulnerabilities were disclosed to Cognition in April 2025 but reportedly remain unpatched after 120+ days.
Summary
A security researcher (publishing via Embrace The Red) conducted a paid security analysis of Devin, an autonomous AI coding assistant developed by Cognition, spending $500 to test it against prompt injection attacks. The research demonstrated multiple exploitation paths in which malicious instructions embedded in GitHub issues or on websites cause Devin to perform unauthorized actions.[0]
Demonstrated impacts include downloading and executing malware (turning Devin into a 'ZombAI' under remote control), exfiltrating confidential data through several channels, and exposing local network ports to the public internet. The findings were responsibly disclosed to Cognition in April 2025 but reportedly remain unpatched after 120+ days, underscoring fundamental security weaknesses in autonomous AI agents and the need for human oversight.[0]
Attack chain
- Injection: An attacker embeds malicious instructions in a GitHub issue or on a website that Devin processes, delivering a prompt injection payload.[0]
- Execution / Compromise: Devin acts on the injected instructions, for example downloading and running malware, giving the attacker remote control and turning it into a 'ZombAI'.[0]
- Exfiltration: Secrets are leaked to third-party servers via shell command execution, browser navigation, markdown image rendering, or Slack integration without user awareness.[0]
- Exposure / Lateral movement: Using a staged method, Devin is coerced into exposing a local port to the internet through its expose_port tool, creating a publicly accessible web server and enabling lateral movement within an organization.[0]
Disclosure timeline
| Date | Event |
|---|---|
| April 2025 | Vulnerabilities responsibly disclosed to Cognition, the developer of Devin.[0] |
| August 06-08, 2025 | Embrace The Red publishes the research posts detailing the prompt injection findings; vulnerabilities reported as still unpatched after 120+ days.[0] |
How it works
Devin's broad, unrestricted internet access and powerful tool set allow attacker-controlled text (in GitHub issues or on websites) to be interpreted as instructions. This prompt injection can drive shell command execution, browser navigation, markdown image rendering, and Slack integration—each usable as a covert channel to send secrets to external servers.[0]
A multi-stage attack leverages malicious websites that inject prompts coercing Devin into creating and publicly exposing a web server via its expose_port tool, making local network ports reachable from the internet. Separately, injected instructions can cause Devin to download and execute malware, resulting in full system compromise and remote control.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Devin AI coding assistant (Cognition) | No specific version stated; described as generally susceptible due to unrestricted internet access and tooling | Reported unpatched 120+ days after April 2025 disclosure[0] |
Key takeaways
- Prompt injection against autonomous AI agents with broad tool and internet access can lead to malware execution, secret exfiltration through multiple channels, and public exposure of internal ports.[0]
- The persistence of these unpatched issues 120+ days after disclosure highlights a fundamental design-level security gap in autonomous AI agents and the necessity of human verification for sensitive operations.[0]
Defensive actions
- Require human verification and oversight for sensitive AI tool invocations.: Autonomous execution of injected instructions is the core weakness; human-in-the-loop review of sensitive actions mitigates unauthorized execution.[0]
- Continuously monitor AI agent activity and constrain internet access and tool use.: Devin's broad internet access and powerful tools enable covert exfiltration and port exposure; monitoring and restrictions reduce exploitation surface.[0]