Devin confidently shipped code that passed tests but had a SQL injection vulnerability
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
Yes
Date
March 21, 2026
Expected Behavior
Use SQLAlchemy ORM or parameterized queries for the search
What Actually Happened
Used f-string interpolation to build raw SQL: f"SELECT * FROM products WHERE name LIKE '%{query}%'". All 8 tests passed.
Damage Assessment
SQL injection vulnerability in production for 2 days before code review caught it. No known exploitation.
Full Report
Tasked with adding a search feature, Devin built it using string concatenation for SQL queries instead of parameterized queries. All functional tests passed because the tests didn't include malicious input. Code review caught it 2 days later.
Incident Metadata
- Agent
- Devin
- Failure Mode
- Security Vulnerability
- Root Cause
- Training Data Gap
- Task Type
- feature
- Domain
- backend
- Source
- github_pr