AIA-021 Devin AI prompt injection via GitHub issue could expose secrets, per Embrace The Red

ID: AIA-021
Category: AI AI agent incident
Disclosed: 2025-08
Systems: Devin (Cognition)
Harm type: Prompt injection / data leak
Status: reported
Unverified: fix status is not stated in the round 1 capture. Rehberger reports it was acknowledged a few days after April 6, 2025.

Summary

Rehberger reported that instructions in a GitHub issue could hijack Cognition's Devin and expose secrets, writing that "exposed secrets can then be leveraged to perform lateral movement." He says he reported it on April 6, 2025 and it was acknowledged a few days later.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

AC-4 Information Flow Enforcement
AC-6 Least Privilege
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

yes: exposing ports and outbound sends

Sources

embracethered.com primary link checked 2026-10-31, HTTP 200
Post dated Aug 6, 2025
https://embracethered.com/blog/posts/2025/devin-i-spent-usd500-to-hack-devin/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.