Devin AI Agent Prompt Injection & Data Exfiltration
Date: 2025-08
Affected: Devin AI Agent Prompt Injection & Data Exfiltration
Attack vector: prompt-injection
Category: real-world
Severity: Medium

Devin's async coding agent had no protection against prompt injection. Multiple exfiltration vectors via Browser tool, Shell tool (curl/wget), Markdown images, and expose_port tool. Devin has unrestricted internet access by default. Reported April 2025; acknowledged but unfixed after 120+ days.


Mitigations:

Architectural layers (MAESTRO):