# ZombAI Exploit with OpenHands: Prompt Injection To Remote Code Execution

Prompt injection in OpenHands agent lured it to a malicious website, causing it to download and execute malware, joining an attacker C2 server.

- Payout: Research
- Severity: high
- Program: OpenHands
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-10
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/openhands-remote-code-execution-zombai/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai
- Tags: area:ai domain:ai impact:internal-access impact:rce kind:research platform:research sev:high tech:llm technique:chained vuln:prompt-injection vuln:rce

**Target:** LLM coding agent (OpenHands) with terminal and browser tools
**Root cause:** Agent processes untrusted web content and follows embedded instructions without distinguishing data from commands, then executes downloaded binaries via its terminal tool.
**Steps:**
1. Give agent a benign task: `visit https://attacker-site.example`
2. Host page containing prompt injection instructing agent to download and run a binary
3. Agent fetches page, follows injected instructions, downloads malware to host
4. Agent executes binary via terminal tool, establishing C2 connection
**How found:** Author reused a prior Anthropic Claude Computer-Use Agent prompt-injection demo, swapping only the executed binary; noted agents readily follow/click links, making attacker-controlled sites a reliable injection vector.
**Exploitation:** Attacker hosts a webpage with injected instructions; agent visits it during normal browsing, downloads attacker binary, executes it, and connects back to attacker C2, yielding full host compromise.
**Escalation:** Also demonstrated AI ClickFix: agent copied shell commands from page and pasted into terminal tool, achieving RCE end to end.
**Insight:** Coding agents that browse and have terminal access will follow links and execute instructions from page content; a single benign 'visit this URL' task is enough to pivot to host RCE via downloaded payloads.