Composite Security Score
41/100
"A $10.2B AI coding agent with SOC 2 compliance and Goldman Sachs on the customer list. Also: an expose_port tool that opens your files to the internet without asking permission. Prompt injection vulnerabilities disclosed in April 2025 went 120+ days without response."
What is Devin?
Devin is an "AI software engineer" built by Cognition Labs. Launched in early 2024, it operates in a sandboxed environment with shell access, a code editor, and browser. At a $10.2B valuation with $400M+ raised from Founders Fund, 8VC, and Khosla Ventures, Devin is the most well-funded AI agent on the market.
Enterprise customers include Goldman Sachs, Citi, Dell, Cisco, Ramp, and Palantir. Cognition reports that one organization saved 5-10% of developer time using Devin for security fixes, with a claimed 20x efficiency gain for vulnerability remediation.
CVE-2024-56083 — Live Stream Exposure
In December 2024, a user discovered live on stream that Devin's VSCode live share URLs were publicly accessible without authentication. The discovery went viral on Hacker News.
Vulnerability Details
URL Format
vscode-[random].devinapps.com
Discovery Method
Screenshot / Stream
Impact
Write access to all code
Time to Fix
Days (auth gate added)
Source: NVD CVE-2024-56083, Hacker News
Security researcher Johann Rehberger spent $500 on 30-day Devin access to test its security. The results, published in August 2025, demonstrate multiple critical vulnerabilities.
| Attack |
Description |
| Prompt Injection |
Malicious GitHub issues/websites compromise Devin |
| Shell Exfiltration |
curl/wget leak secrets within milliseconds |
| expose_port Abuse |
Opens files to internet without approval |
| Image Exfiltration |
Data appended to image URLs leaks to attackers |
| Malware Execution |
Downloaded and ran C2 binary; Devin added exec permissions |
Disclosure Timeline
Reported to Cognition
April 6, 2025
Acknowledged
Days later
Response on Fix Timeline
None after 120+ days
Public Disclosure
August 2025
Source: Embrace The Red — "I Spent $500 To Test Devin AI For Prompt Injection"
The expose_port Problem
Devin has a built-in tool that opens any local port to the public internet. It can be triggered without human approval.
# Tool definition from Devin's system prompt:
"Exposes a local port to the internet and returns a public URL."
Attack Chain:
- Attacker plants malicious instructions on website
- Devin processes website, gets compromised via prompt injection
- Devin starts web server exposing all files
- Invokes expose_port tool (no human approval needed)
- Returns public URL (*.devinapps.com)
- Attacker accesses all files over public internet
Why This Matters: This violates the principle of least privilege. A tool that exposes internal systems to the internet should never execute without explicit human approval.
What Devin Gets Right
SOC 2 Type II Certified
Certified since September 2024, covering data security, privacy, processing integrity, confidentiality, and availability.
VPC Deployment Option
Enterprise customers can keep all data in their own environment. Communication encrypted in transit.
Quick CVE Response
CVE-2024-56083 was fixed within days of discovery by adding auth gate to VSCode sessions.
No Training on Customer Data
Models are not trained on customer data or code by default. Customer owns generated output IP.
Expert Warnings
"Do not depend on model-behavior, in-chat confirmations or prompting for secure tool invocation. Be transparent that any secret on a Devin box can be compromised by an adversary via a prompt injection attack from untrusted data."
— Johann Rehberger, Embrace The Red
"Compromised agents with shell/browser/editor access (like Devin AI) can exfiltrate data beyond the immediate codebase."
— Pillar Security, "Hidden Security Risks of SWE Agents"
"Teams should treat Devin like a capable junior developer in a sandbox: scope tasks, require tests, review patches, and enforce CI/CD and security guardrails."
— Cognition Documentation
The Question That Matters
Devin represents the tension at the heart of AI agents: to be useful, they need access to tools. To be secure, that access needs guardrails. Devin has SOC 2 compliance and enterprise customers — that's real. It also has a tool that exposes your file system to the internet without asking permission. Security researcher disclosure went 120+ days without a timeline response. You can have a $10B valuation and still ship dangerous defaults. The enterprise security story is marketing. The expose_port tool is architecture. Which one matters more depends on whether you've been compromised yet.
Would I Deploy This in Production?
CAUTIOUSLY
Devin has the most complete enterprise security story of any AI agent we've reviewed — SOC 2 certification, VPC deployment, dedicated security contact. But the demonstrated vulnerabilities are serious, and the 120+ day disclosure gap is concerning. Use the VPC deployment. Don't give Devin access to production secrets. Assume anything it touches could be exfiltrated. Those guardrails make it usable. Without them, it's a liability.