Disclosed vulnerability
Devin AI leaks secrets via curl, browser navigation, image rendering and hyperlinks
AIR-2025-0087 AIR record · 2025-08-devin-secret-leaks
From the supporting source
Many vendors of agentic systems over-rely on the model doing the right thing.embracethered.com
The record
Disclosed
2025-08-07
Vendor
Cognition
Product
Devin AI
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — Devin curled, browsed and rendered images to leak secrets
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Devin workspaces and the secrets stored in them
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
unresolved at publication; reported 2025-04-06, follow-ups unanswered
Taxonomy & references
Curator notes
Month of AI Bugs 2025.
Supporting sources
Cite as
Enkrypt AI. "Devin AI leaks secrets via curl, browser navigation, image rendering and hyperlinks". AIR, AIR-2025-0087. https://agentincident.vercel.app/i/AIR-2025-0087/ (accessed 2026-10-19).