Misbehavior1 sourceFirst seen
OpenHands Visits a Website, Takes Instructions From It, Becomes a ZombAI
Ourtake
Agents are naive systems, and a single web page was enough to turn a coding agent into a remote-controlled zombie.
What happened
Security researcher Johann Rehberger published a working prompt-injection exploit against OpenHands, an agent from All Hands AI. Hidden instructions on a website led the agent to download, run and connect a malware binary to an attacker-controlled command-and-control server. The vulnerability was disclosed privately in March 2025 and made public on August 10, 2025 after no fix was reported.