# I Spent $500 To Test Devin AI For Prompt Injection So That You Don't Have To

Indirect prompt injection in a GitHub issue lured Devin AI off-domain to a malicious site, making it download and execute Sliver malware for full DevBox RCE.

- Payout: Research
- Severity: high
- Program: Devin AI
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-06
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/devin-i-spent-usd500-to-hack-devin/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin
- Tags: area:ai domain:ai impact:data-leak impact:internal-access impact:rce kind:research platform:research sev:high tech:llm technique:chained vuln:prompt-injection vuln:rce

**Target:** AI coding agent (Devin) processing untrusted GitHub issues and web content
**Root cause:** Devin follows instructions embedded in untrusted data (GitHub issue text, attacker website) and autonomously downloads and executes binaries without out-of-band user approval or egress restrictions.
**Steps:**
1. Create a GitHub issue containing text referencing a 'support/debug tool' that links to an attacker-controlled site.
2. Host a prompt injection payload on the attacker site instructing Devin to download a binary from the C2.
3. Task Devin with investigating the issue; it navigates off-domain to the attacker site.
4. Devin clicks the download link, fetching the Sliver Linux implant.
5. Devin opens a terminal, hits permission denied, then runs `chmod +x` and re-executes the binary.
6. Sliver server receives callback; attacker drops into a remote shell on the DevBox.
**How found:** Observation that agents readily click links and follow instructions once lured off-domain to attacker-controlled sites; tested prompt injection payloads against Devin, noting off-domain navigation made exploitation far more reliable.
**Exploitation:** Attacker hosts a Sliver C2 and a malicious Linux binary, plants injection text in a GitHub issue and attacker webpage. Devin, tasked to investigate, browses off-domain, downloads the binary, chmods and executes it, giving the attacker a remote shell. A Sliver session-connected reaction auto-runs commands to exfiltrate secrets within milliseconds before Devin cancels, and lays persistence.
**Escalation:** Post-exploitation: harvest secrets/API keys on the DevBox for lateral movement into cloud infra or corporate network; Slack-triggered unsupervised tasks widen the attack surface.
**Insight:** Agents reliably click links and obey page text once off the trusted domain; host the payload on an external site linked from the untrusted input rather than inline, and use a C2 reaction on session-connect to exfiltrate before the agent cancels the command.