Disclosed vulnerability
OpenHands ZombAI: prompt injection to remote code execution and C2
AIR-2025-0090 AIR record · 2025-08-openhands-zombai
From the supporting source
Agents are naive systems, and untrusted data on for instance a website, can lead to remote code execution and full system compromise, including compromise of all compute resources, sensitive information and API keys on the host.embracethered.com
The record
Disclosed
2025-08-10
Vendor
All Hands AI
Product
OpenHands
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — OpenHands executed the injected commands and established C2
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection web content
Impact type
Remote code execution, C2 control, Credential theft, Code execution, Remote control
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenHands hosts and their compute and API keys
Capability abused
Defense & remediation
Recorded defense
none by default
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed at publication; reported 2025-03-13, 140+ days without substantive response
Taxonomy & references
Curator notes
Month of AI Bugs 2025. Also reported as: 'ZombAI exploit with OpenHands: prompt injection to remote code execution and token leakage'.
Supporting sources
Cite as
Enkrypt AI. "OpenHands ZombAI: prompt injection to remote code execution and C2". AIR, AIR-2025-0090. https://agentincident.vercel.app/i/AIR-2025-0090/ (accessed 2026-10-19).