Disclosed vulnerability
OpenHands and the lethal trifecta: zero-click leak of GitHub tokens via image rendering
AIR-2025-0089 AIR record · 2025-08-openhands-lethal-trifecta
From the supporting source
The OpenHands agent renders images in chat, which enables zero-click data exfiltration.embracethered.com
The record
Disclosed
2025-08-09
Vendor
All Hands AI
Product
OpenHands
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — OpenHands rendered the image, leaking the GitHub token
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection web content
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenHands containers holding GitHub tokens
Capability abused
Defense & remediation
Recorded defense
model refusals (bypassable)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
not fixed at publication; reported 2025-03-13, disclosed after 148 days
Taxonomy & references
Curator notes
Month of AI Bugs. The term lethal trifecta was coined by Simon Willison.
Supporting sources
Cite as
Enkrypt AI. "OpenHands and the lethal trifecta: zero-click leak of GitHub tokens via image rendering". AIR, AIR-2025-0089. https://agentincident.vercel.app/i/AIR-2025-0089/ (accessed 2026-10-19).