Misbehavior1 sourceFirst seen
OpenHands Agent Hands Over Its GitHub Token Because a Webpage Asked Politely
Ourtake
Redaction was beaten with Base64 and the model's refusal with a substring. Security boundaries remain optional.
What happened
A security researcher showed that the OpenHands coding agent, made by All-Hands AI, could be hijacked by a prompt injection hidden on a webpage. The injected payload forced the agent to render an image that leaked its GITHUB_TOKEN to a third-party server, encoded in Base64 to evade secret redaction. The researcher disclosed the flaw privately in March 2025 and published it in August 2025, when the vendor had not yet triaged it.