MisbehaviorSerious1 sourceFirst seen
Devin Gets Tricked Into Spilling Its Secrets Four Different Ways, Because Reading a GitHub Issue Is Apparently Dangerous
Ourtake
Agents are naive: untrusted text on a website can take control of the AI and ship your environment variables off to a stranger.
What happened
A security researcher showed that Cognition's Devin AI coding agent could be hijacked via indirect prompt injection in a GitHub issue to leak environment variables and secrets to third-party servers through shell commands, browser navigation, markdown image rendering and Slack links. The researcher reported the issues to Cognition in April 2025 and published them after 120+ days with no answered follow-up on fixes.