# Jules Zombie Agent: From Prompt Injection to Remote Control

Indirect prompt injection in a GitHub issue hijacked Google Jules, invoking run_in_bash_session to download a Sliver implant and establish C2 on the dev box.

- Payout: Research
- Severity: high
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-14
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/google-jules-remote-code-execution-zombai/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai
- Tags: area:ai domain:ai impact:internal-access impact:rce kind:research platform:research sev:high tech:llm technique:chained technique:source-review vuln:prompt-injection vuln:rce

**Target:** AI coding agent (Jules) with bash tool and GitHub issue ingestion
**Root cause:** Jules ingests untrusted GitHub issue content as instructions and auto-invokes the run_in_bash_session tool without re-confirmation, combined with unrestricted outbound network access.
**Steps:**
1. Tag a GitHub issue with `jules` so the agent picks it up as a task.
2. Embed indirect prompt injection in the issue body instructing the agent to use `run_in_bash_session`.
3. Payload downloads a Sliver implant binary via outbound Internet (unrestricted egress).
4. Execute the implant to connect back to attacker's Sliver C2 server.
5. Plan containing malicious actions is auto-approved (20s, later 120s) or tools invoked automatically mid-session.
**How found:** Read the worker agent's system prompt to enumerate available tools (run_in_bash_session), tested outbound connectivity, then crafted indirect prompt injection via GitHub issue to drive tool invocation.
**Exploitation:** Attacker plants prompt injection in a GitHub issue; Jules plans and auto-approves actions, uses run_in_bash_session to curl/download the Sliver binary and execute it, giving the attacker remote control of the dev box (ZombAI).
**Escalation:** Full-system compromise of the agent's dev box; potential lateral movement if private code or production secrets are accessible.
**Insight:** Enumerate an agent's tool list from its system prompt and test egress; a single shell tool plus unrestricted Internet turns any untrusted-content ingestion point (issues, docs) into RCE. Also note plan approval only occurs at session start, so later tasks invoke tools without confirmation.