{
 "public_id": "AIR-2025-0095",
 "incident_id": "2025-08-devin-rce",
 "date_disclosed": "2025-08-14",
 "date_occurred": null,
 "title": "Devin autonomous coding agent downloaded and self-escalated C2 malware from an injected GitHub issue",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_github_issue_or_website",
 "agent_capability_abused": [
  "web_browsing",
  "file_download",
  "shell_execution",
  "chmod_self_escalation",
  "port_exposure",
  "shell_command_execution"
 ],
 "target_product": "Devin",
 "target_vendor": "Cognition AI",
 "autonomy_level": "fully_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "credential_theft",
  "c2_implant",
  "lateral_movement"
 ],
 "blast_radius": "Devin's cloud workspace VM per session, including any tokens and API keys present on the host",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "no_prompt_injection_defense",
   "agent_self_escalation",
   "sliver_c2",
   "unpatched_at_disclosure",
   "indirect_prompt_injection",
   "malware_execution"
  ]
 },
 "defense_present": "none observed by the researcher",
 "defense_bypassed": true,
 "fix_shipped": "Unknown - reported to Cognition 2025-04-06; the researcher reported no substantive response after 120+ days",
 "primary_sources": [
  "https://embracethered.com/blog/posts/2025/devin-i-spent-usd500-to-hack-devin/"
 ],
 "verified_quote": "By planting instructions on a website or GitHub issue that Devin processes, it can be tricked to download malware and launch it.",
 "confidence": "high",
 "notes": "Johann Rehberger. Most striking detail: when execution was blocked by file permissions, Devin independently opened another terminal, added the execute bit to the Sliver C2 binary and ran it again - the agent removed its own obstacle. He also demonstrated exposing server ports to the internet and leaking access tokens to external endpoints. Tested against the live commercial product, but no real victim, so impact_realized=false. | Merged from duplicate id `2025-04-devin-prompt-injection-malware`. Also reported as: 'I spent $500 to test Devin AI for prompt injection: malware download and execution'.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape",
  "Persistence & Covert C2",
  "Over-permissioned execution & lateral movement"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Devin downloaded, chmod'd and launched the C2 malware",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_github_issue_or_website",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "devin",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: credential_theft",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec), ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}