Disclosed vulnerability
Jules Zombie Agent: prompt injection in a GitHub issue to remote control of the Jules dev box
AIR-2025-0096 AIR record · 2025-08-google-jules-zombai
From the supporting source
The attacker can now remote control Jules' dev box, it's now a ZombAI.embracethered.com
The record
Disclosed
2025-08-14
Vendor
Google
Product
Google Jules
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Jules executed the injected commands, giving remote control of its box
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Remote code execution, C2 control, Code execution, Remote control
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Jules VM instances
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed at publication; Google triaged the 2025-06-01 report as an abuse risk and closed it 2025-06-13 as already tracked
Taxonomy & references
Curator notes
Month of AI Bugs 2025. Also reported as: 'Jules Zombie Agent: prompt injection to remote control of Google Jules'.
Supporting sources
Cite as
Enkrypt AI. "Jules Zombie Agent: prompt injection in a GitHub issue to remote control of the Jules dev box". AIR, AIR-2025-0096. https://agentincident.vercel.app/i/AIR-2025-0096/ (accessed 2026-10-19).