Prompt injection and jailbreaks

The post reports that OpenHands, an AI agent from All Hands AI (formerly named OpenDevin), can be hijacked through prompt injection using untrusted data, such as content from a website. The author states this impacts confidentiality, integrity, and availability of the system.

OpenHands, an agent previously called OpenDevin and created by All-Hands AI, renders images in chat. This enables zero-click data exfiltration, which the source describes as an exploit pattern Simon Willison named the Lethal Trifecta.

Researchers describe a hidden expose_port tool in Devin's system prompt that publishes a local port to the public Internet and returns a public URL. They show a multi-stage indirect prompt injection on a website that makes Devin start a Python web server exposing its filesystem, expose the port, and leak the resulting .devinapps.com URL to an attacker. The source notes that the tool can be invoked without a human in the loop.

Johann Rehberger shows how an attacker can use indirect prompt injection to make Devin, the AI coding agent, send secrets to third-party servers. Devin's built-in secrets management exposes user-defined secrets as environment variables at runtime, and these become the exfiltration target. The author identifies four vectors: the Shell tool (curl, wget or a Python script), the Browsing tool navigating to an attacker-controlled URL with data appended, Markdown image rendering from untrusted domains, and hyperlinks with invisible Unicode characters sent through the Slack integration. The Shell vector works because Devin has unrestricted Internet access by default.

Security researcher Johann Rehberger published a proof-of-concept showing that Devin AI from Cognition, described as the first AI Software Engineer, can be compromised through prompt injection. Instructions planted on a website or GitHub issue that Devin processes can trick it into downloading and launching malware, fully compromising its DevBox and turning it into a remote-controlled ZombAI. Any exposed secrets can then be used for lateral movement.

Researcher Johann Rehberger describes an attack chain against Amp, an agentic coding tool built by Sourcegraph, in which the agent could write to the user's VS Code settings.json file outside the project folder without approval. An attacker, or the model itself through indirect prompt injection, could add wildcard or malicious entries to the allowlisted bash commands or add a malicious MCP server, achieving arbitrary code execution on the developer's machine. The issue was reported to Sourcegraph and fixed within a few days.

Researcher Johann Rehberger reports that Cursor, an AI code editor, renders Mermaid diagrams and will issue requests to external servers when an image is embedded, letting data leave its sandbox without human confirmation. Through indirect prompt injection, an attacker can hijack Cursor and exfiltrate data such as user memories or API keys stored in a configuration file, which are embedded as URL query parameters in an image link. The issue is tracked as CVE-2025-54132.

Embrace The Red shows that ChatGPT Codex, OpenAI's cloud software engineering agent, can be hijacked through indirect prompt injection, such as a malicious GitHub issue, once Internet access is enabled. The post finds that the "Common Dependencies" allowlist includes azure.com, which an attacker can use by hosting a VM with a cloudapp.azure.com DNS name to run a Sliver command and control server and turn Codex into a botnet, a result the author calls ZombAI. Compromise would expose environment variables, source code and compute resources on the Codex machine.

CVE-2025-54132 affects Cursor, a code editor built for programming with AI, in versions below 1.3. Mermaid diagram rendering allows embedded images that Cursor displays in the chat box, and an attacker can use this to exfiltrate sensitive information to an attacker-controlled server via an image fetch after a successful prompt injection. The flaw can also be triggered by a malicious or backdoored model, and exploitation requires prompt injection from malicious data such as web content, image uploads or source code.

CVE-2025-54131 affects Cursor, a code editor built for programming with AI, in versions below 1.3. When a user has switched from the default approval-for-every-terminal-call setting to an allowlist, an attacker can bypass the allow list in auto-run mode using a backtick (`) or $(cmd) and execute arbitrary commands without user approval. The flaw can be triggered when chained with indirect prompt injection.

A researcher shows that a bypass in OpenAI's url_safe rendering feature lets ChatGPT send personal data, including chat history, to a third-party server. An attacker can trigger this through prompt injection hidden in untrusted content such as a website or PDF. The proof of concept routes data to an Azure Blob Storage account on blob.core.windows.net, where the attacker reads the leaked content from storage logs. The researcher reported related bypasses to OpenAI in October 2024 and says the underlying root cause, first reported over two years earlier, remains unfixed.