Google Jules coding agent prompt-injected via a GitHub issue into remote code execution

System

Framework

Google Jules (asynchronous coding agent)

Tools

run_in_bash_session, github

Vendor

Google

Autonomy

supervised-autonomous

Classification

Primary class

prompt-injection

Chain

prompt-injection/indirect → tool-misuse/unvalidated-args → unsafe-action

Attack vector

untrusted-content

Causation

entity: human · intentionality: intentional · timing: post-deployment

Trigger

An attacker placed hidden instructions in a GitHub issue tagged for Jules. When the agent processed the issue, it treated the embedded text as commands and used its bash tool to fetch and execute attacker-supplied code, establishing a command-and-control channel.

Root cause

Untrusted repository content entered the agent's context with the same standing as user instructions, while the agent's bash tool had unrestricted outbound network access and attacker-controlled arguments were executed without a human gate. The agent approves a plan only once at session start, and that plan was auto-approved after a short timeout, so later attacker-directed steps ran without renewed review.

Contributing factors

• Public GitHub issue content shared the instruction channel with the user's task.
• The bash tool allowed arbitrary commands with unrestricted outbound network egress.
• Plans were auto-approved after a short timeout, removing the human approval gate.
• The agent environment held repository access and credentials reachable once code ran.

Detection

Discovered and disclosed by independent security researcher Johann Rehberger (Embrace The Red) as part of the Month of AI Bugs 2025; independently referenced by a Cloud Security Alliance research note on promptware-to-C2.

Recovery

Privately reported to Google on 2025-06-01; Google triaged it as an abuse risk and closed the ticket on 2025-06-13 as already tracking the behavior, without a publicly confirmed remediation.

Prevention

Separate untrusted repository content from instructions; restrict or egress-filter the agent's network access; require human approval before executing attacker-influenced commands; re-validate plans when new untrusted content is introduced rather than auto-approving on a timer; constrain tool scope and credentials available to the execution environment.

Blast radius

Data

The demonstrated code execution exposed the agent environment's environment variables and credentials and any repositories it could reach, shown in a researcher proof of concept. credentials

User harm

Potential full compromise of a developer's coding-agent environment, including connected repositories and secrets; shown as a PoC without wild exploitation. none-reported

Scope

Google Jules sessions processing untrusted GitHub issue content

Reversibility

irreversible

References

OWASP LLM

LLM01 LLM06

OWASP Agentic

T2 T3

MITRE ATLAS

AML.T0051 AML.T0053

Tags

coding-agent indirect-prompt-injection rce zombai command-and-control month-of-ai-bugs

Sources

• Jules Zombie Agent: From Prompt Injection to Remote ControlEmbrace The Red · primary-research · archived
• Promptware: When Prompt Injection Becomes C2Cloud Security Alliance · academic · archived