Misbehavior1 sourceFirst seen
Devin Was Told to Read a Website and Published Its Own Filesystem to the Internet
Ourtake
Nobody asked Devin to open its doors to the whole internet, but a sneaky webpage did the asking for it.
What happened
A security researcher showed that a malicious website could use indirect prompt injection to make Cognition's Devin AI agent start a file-serving web server and expose a port to the public internet. The researcher reported the issue to Cognition on April 6, 2025, and says follow-up questions about a fix went unanswered. The findings were published on August 8, 2025 after the 120-day disclosure window.