# Agent downloads and runs untrusted binaries

Agent browses untrusted content and can fetch and execute binaries or scripts without out-of-band approval

_Area: AI and LLM app security. Seen in 5 disclosed reports; latest 2025-08-10. Updated 2026-10-23._

## How it works
Agents treat untrusted content as instructions. Text in a GitHub issue, web page, or task input can tell the agent to visit an attacker site, download a binary or script, and run it through its terminal or browser tool. The broken assumption is that the agent distinguishes data from commands, and that per-tool guardrails bound what the whole agent can do. Neither holds: once the agent is off the trusted domain, it obeys page text and executes the payload [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai.md).

## Where it shows up
- Agent ingests untrusted text (issues, web pages, task prompts) and has both browsing and shell/terminal tools.
- Download-and-execute reachable through any tool, including the browser download flow, not just bash [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md).
- No out-of-band human approval before running fetched binaries [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md).
- No egress restrictions; agent can reach arbitrary external hosts [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md).
- A single benign "visit this URL" task is enough to pivot to host execution [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai.md).

## How to review
The invariant: no binary or script that originated from untrusted content may execute without explicit out-of-band approval, and no single tool may bypass that gate. Check that downloads and execution are gated at the agent level, not per tool; that the browser download path is subject to the same approval as the shell; that egress is restricted to allowlisted hosts; and that untrusted page or issue text cannot trigger a fetch-and-run chain. Trace every path from untrusted input to process execution.

## Variants seen
- Indirect injection via GitHub issue luring the agent off-domain to a malicious site, then download and execute [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md).
- Malicious web page injecting a computer-use agent to fetch and run an implant, joining attacker C2 [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md).
- Bash guardrail bypassed by routing the download through the browser tool instead [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md).
- Coding agent with terminal access pivoting from a benign URL-visit task to host RCE [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai.md).

## Why fixes fail
Per-tool guardrails do not compose: blocking downloads in bash left the browser download flow open, and the agent used it to fetch and execute the same payload [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md).

## Impact and severity
Full host or DevBox remote code execution and enrollment in attacker C2 [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai.md). Severity is high: autonomous execution, no approval step, and unrestricted egress make a single injected instruction sufficient. Missing egress controls and cross-tool trust gaps widen the blast radius.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-i-spent-usd500-to-hack-devin.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-claude-computer-use-c2-the-zombais-are-coming.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-remote-code-execution-zombai.md