Disclosed vulnerability
Devin autonomous coding agent downloaded and self-escalated C2 malware from an injected GitHub issue
AIR-2025-0095 AIR record · 2025-08-devin-rce
From the supporting source
By planting instructions on a website or GitHub issue that Devin processes, it can be tricked to download malware and launch it.embracethered.com
The record
Disclosed
2025-08-14
Vendor
Cognition AI
Product
Devin
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Devin downloaded, chmod'd and launched the C2 malware
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue or website
Impact type
Remote code execution, Credential theft, C2 implant, Lateral movement
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Devin's cloud workspace VM per session, including any tokens and API keys present on the host
Capability abused
Defense & remediation
Recorded defense
none observed by the researcher
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Unknown - reported to Cognition 2025-04-06; the researcher reported no substantive response after 120+ days
Taxonomy & references
Curator notes
Johann Rehberger. Most striking detail: when execution was blocked by file permissions, Devin independently opened another terminal, added the execute bit to the Sliver C2 binary and ran it again - the agent removed its own obstacle. He also demonstrated exposing server ports to the internet and leaking access tokens to external endpoints. Tested against the live commercial product, but no real victim, so impact_realized=false. | Merged from duplicate id `2025-04-devin-prompt-injection-malware`. Also reported as: 'I spent $500 to test Devin AI for prompt injection: malware download and execution'.
Cite as
Enkrypt AI. "Devin autonomous coding agent downloaded and self-escalated C2 malware from an injected GitHub issue". AIR, AIR-2025-0095. https://agentincident.vercel.app/i/AIR-2025-0095/ (accessed 2026-10-19).