Disclosed vulnerability
Devin AI exposes local ports to the public internet under indirect prompt injection
AIR-2025-0088 AIR record · 2025-08-devin-expose-ports
From the supporting source
Devin executes consequential tool commands, such as exposing a port, without seeking human verification.embracethered.com
The record
Disclosed
2025-08-08
Vendor
Cognition
Product
Devin AI
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Devin exposed its own local ports to the internet
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection web content
Impact type
Unauthorized action, Data exfiltration, Exposure of internal service, Code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Devin workspaces
Capability abused
Defense & remediation
Recorded defense
none - expose_port runs without human verification
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
unknown; reported 2025-04-06 and acknowledged, no fix status after 120+ days
Taxonomy & references
Curator notes
Month of AI Bugs 2025. Also reported as: 'AI Kill Chain in action: Devin AI exposes ports to the internet under prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Devin AI exposes local ports to the public internet under indirect prompt injection". AIR, AIR-2025-0088. https://agentincident.vercel.app/i/AIR-2025-0088/ (accessed 2026-10-19).