# How Devin AI Can Leak Your Secrets via Multiple Means

Indirect prompt injection in Devin AI agent lets attackers exfiltrate secrets via shell, browser, markdown images, and Slack hyperlinks with invisible Unicode.

- Payout: Research
- Severity: high
- Program: Devin
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-07
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/devin-can-leak-your-secrets/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** AI coding agent (Devin) with shell, browser, and Slack integration
**Root cause:** Devin's system prompt grants unrestricted Shell and Browser tools with default internet access, and renders markdown images/hyperlinks from untrusted domains, so untrusted content (e.g. GitHub issue text) can hijack the agent into exfiltrating environment variables.
**Steps:**
1. Plant malicious instructions in a GitHub issue body that Devin is asked to investigate.
2. Ask Devin to investigate the latest open GitHub issue.
3. Devin follows injected instructions: runs `env | sort` and greps for secret patterns.
4. Vector 1: Devin constructs `curl`/`wget` or a Python script to POST env vars to attacker server.
5. Vector 2: Devin navigates browser to attacker URL with encoded secrets appended.
6. Vector 3: Devin renders a markdown image pointing to attacker domain with secrets in the URL.
7. Vector 4: Devin posts a Slack hyperlink containing invisible Unicode Tag characters encoding secrets; clicking URL-encodes them into the request.
**How found:** Reviewed Devin's system prompt to enumerate available tools (Browser, Shell), noticed unrestricted internet access and markdown rendering, then tested indirect prompt injection via a GitHub issue to trigger each exfil channel.
**Exploitation:** Attacker embeds prompt injection in content Devin ingests (GitHub issue). Devin's shell/browser tools then read env vars (secrets) and exfiltrate via curl, browser navigation, markdown image fetch, or Slack link with ASCII-smuggled payload; user click completes the Slack vector.
**Escalation:** Multiple independent exfil channels (shell, browser, image render, Slack link) increase reliability; grep-by-pattern bypasses model refusals; invisible Unicode hides data in UI.
**Insight:** Audit an agent's system prompt for tool grants (shell, browser, image/link rendering) and default network egress; grep-by-pattern rather than exact secret strings evades model refusals, and invisible Unicode Tag chars in links leak on click via URL encoding.