# AI Kill Chain in Action: Devin AI Exposes Ports to the Internet with Prompt Injection

Indirect prompt injection tricks Devin AI into running a file-serving Python server and invoking expose_port, leaking the filesystem via a public .devinapps.com URL.

- Payout: Research
- Severity: high
- Program: Devin AI
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-08
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/devin-ai-kill-chain-exposing-ports/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-ai-kill-chain-exposing-ports
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** AI coding agent (Devin) expose_port tool and browsing
**Root cause:** Devin's expose_port tool publishes any local port to the internet and is invocable by the model without out-of-band human approval, so untrusted web content can drive it via indirect prompt injection.
**Steps:**
1. Host a webpage containing stage-1 injection instructing Devin to start a Python HTTP server serving the filesystem on port 8000.
2. Stage-1 page redirects to a stage-2 page with further instructions to invoke expose_port on port 8000.
3. Stage-2 uses image markdown to exfiltrate the returned .devinapps.com URL to the attacker's server.
4. Attacker browses the leaked public URL and downloads files from the Devbox filesystem.
**How found:** Reading Devin's system prompt revealed the expose_port tool; the researcher hypothesized indirect prompt injection could invoke it without human approval, then built a multi-stage PoC after single-stage prompts were refused.
**Exploitation:** Attacker-controlled site is visited by Devin during unsupervised research; multi-stage injection splits actions across pages to bypass refusals, spawns a file server, exposes it publicly, and leaks the URL via image-markdown callback.
**Escalation:** Splitting the payload across multiple domains/stages steered the agent past its initial refusals.
**Insight:** Audit agent system prompts for tools that publish internal state externally (port exposure, URL generation); these are confused-deputy primitives. When a single injection is refused, split the chain across redirects/pages so each step looks benign.