Amp coding agent could be prompt-injected into modifying its own config to reach command execution
2025-amp-code-config-modification-rce · 2025-08-05
In Amp, Sourcegraph's agentic coding tool, the agent could edit the user's VS Code config file, which stored both the bash commands allowlisted to run without approval and the registered MCP servers. A researcher showed an indirect prompt injection could make the agent allowlist a command or register a malicious MCP server, escaping the approval boundary to run arbitrary commands. Sourcegraph fixed it shortly after disclosure; no CVE was assigned.
System
- Framework
- Amp (Sourcegraph)
- Tools
- vscode, shell, mcp, amp
- Vendor
- Sourcegraph
- Autonomy
- human-in-the-loop
Classification
- Primary class
- prompt-injection
- Chain
- prompt-injection/indirect → excessive-agency/missing-approval-gate → unsafe-action/unauthorized-write
- Attack vector
- untrusted-content
- Causation
- entity: human · intentionality: intentional · timing: post-deployment
Trigger
Instructions embedded in untrusted content the agent processed (for example a code comment) directed the agent to write to the user's VS Code configuration file. Because that file stored both the allowlist of bash commands runnable without confirmation and the set of registered MCP servers, the injected instructions could add an entry that let a subsequent command run without the approval prompt — either by allowlisting it or by registering an attacker-chosen MCP server — reaching arbitrary command execution.
Root cause
The agent could modify the configuration that defined its own approval boundary: the same file that listed pre-approved commands and trusted MCP servers was writable by the agent from untrusted input. Self-modification of the allowlist and server registry let a single injection escalate past the human-in-the-loop confirmation to command execution.
Contributing factors
- The command allowlist and MCP server registry lived in a config file the agent could write.
- Untrusted content processed by the agent was treated with the same authority as user instructions.
- A change to the approval boundary did not itself require out-of-band user confirmation.
Detection
Discovered and disclosed by researcher Johann Rehberger (wunderwuzzi) as part of the Month of AI Bugs 2025 series; reported privately to Sourcegraph in early July 2025 and published 2025-08-05.
Recovery
Sourcegraph fixed the issue shortly after the private report; the researcher reported the behaviour as resolved by the time of publication. No CVE was assigned.
Prevention
Do not let an agent modify its own approval surface — the command allowlist or MCP server registry — from untrusted input; gate changes to that surface behind explicit out-of-band user action; treat processed file content as untrusted; keep command and server additions requiring confirmation by default.
Blast radius
- Data
- Exploitation allowed arbitrary command execution on the developer's machine once the agent had altered its own allowlist or registered an attacker-chosen MCP server. internal
- User harm
- A disclosed vulnerability with a vendor fix; no confirmed in-the-wild exploitation was reported. none-reported
- Scope
- Amp (Sourcegraph) users before the fix
- Reversibility
- reversible
References
- CWE
- CWE-77
- OWASP LLM
- LLM01 LLM06
- MITRE ATLAS
- AML.T0051
- Related
- 2025-github-copilot-autoapprove-rce 2025-amazon-q-find-exec-rce 2025-whatsapp-mcp-tool-poisoning
- Tags
- prompt-injection rce amp sourcegraph mcp allowlist self-modification approval-bypass no-cve
Sources
Cite this incident
Permalink: https://swarmproof.github.io/agent-postmortems/2025-amp-code-config-modification-rce/
@misc{2025-amp-code-config-modification-rce,
title = {Amp coding agent could be prompt-injected into modifying its own config to reach command execution},
year = {2025},
howpublished = {agent-postmortems},
url = {https://swarmproof.github.io/agent-postmortems/2025-amp-code-config-modification-rce/}
}