Cross-agent privilege escalation: one coding agent writes another's config files to lift its restrictions
2025-cross-agent-privilege-escalation-config-poisoning · 2025-09-24
Security research showed that when multiple coding agents share a developer workspace, a prompt-injected agent can write to the configuration, instruction, and task files of a second agent (e.g. .mcp.json, .vscode/settings.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) without user approval. On next run the second agent loads the planted settings and executes attacker-controlled code, "freeing" it from its sandbox and chaining into a multi-agent compromise.
System
- Framework
- Multiple coding agents sharing a workspace (GitHub Copilot, Claude Code, Gemini CLI, AWS Kiro)
- Tools
- mcp, vscode
- Vendor
- Multiple (GitHub/Microsoft, Anthropic, Google, AWS)
- Autonomy
- supervised-autonomous
Classification
- Primary class
- multi-agent-failure
- Chain
- multi-agent-failure/cascade → prompt-injection/indirect → excessive-agency/scope-creep
- Attack vector
- untrusted-content
- Causation
- entity: human · intentionality: intentional · timing: post-deployment
Trigger
In a shared developer workspace configured for several coding agents, an attacker places indirect prompt-injection content in untrusted data the first agent processes. The compromised agent writes a malicious MCP server entry, command allowlist, VS Code task, or instruction line into a second agent's configuration or instruction file. When a developer next runs the second agent, it loads the planted settings as trusted and executes attacker-controlled commands, and the escalation can loop back to re-arm the first agent.
Root cause
Coding agents on a shared workspace can read and write each other's configuration, instruction, and task files (for example .mcp.json, .vscode/settings.json, .gemini/settings.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) without explicit user approval, and treat those files as trusted at load time. No trust boundary isolates one agent's configuration from another, so compromise of one agent can expand capabilities or remove sandbox restrictions on another.
Contributing factors
- Agents auto-write to project dotfiles and instruction files without explicit user approval.
- Configuration and instruction files are loaded as trusted at startup, enabling code execution via MCP servers, command allowlists, or editor tasks.
- Multiple agents share one workspace with no isolation between their configuration namespaces.
- Each agent can broaden its own or another agent's capabilities on the fly, so a single foothold can escalate across agents.
Detection
Demonstrated and publicly disclosed by security researcher Johann Rehberger (Embrace The Red) in a writeup dated 2025-09-24, with independent coverage the same day. The author reported findings to Microsoft's MSRC, which assessed them as not severe enough to require immediate security servicing.
Recovery
No single-vendor fix was issued; the demonstration was conducted in a researcher-controlled environment with no evidence of real-world exploitation. The researcher recommends isolating each agent's configuration, proposing rather than auto-applying changes to dotfiles, and least-privilege execution.
Prevention
Isolate each agent's configuration so other agents cannot write it; require explicit user approval before writing to configuration, instruction, or task dotfiles; treat configuration and instruction files as untrusted input rather than trusted at load; apply least-privilege execution and sandboxing that on-the-fly configuration changes cannot widen.
Blast radius
- Data
- The demonstrated effect is arbitrary code execution in the developer environment, which could expose local secrets, credentials, and source code; the proof of concept did not exfiltrate specific data. unknown
- User harm
- A researcher proof of concept; no in-the-wild exploitation was reported. Realized exploitation could yield arbitrary code execution and sandbox escape on a developer workstation. none-reported
- Scope
- developer workstations where multiple coding agents share a workspace and can write each other's configuration, instruction, or task files
- Reversibility
- partially-reversible
References
- OWASP LLM
- LLM01 LLM06
- OWASP Agentic
- T3 T13
- MITRE ATLAS
- AML.T0051
- Related
- 2026-google-adk-agent-privilege-escalation 2026-loopjacking-approve-execute-mismatch 2026-mind-viruses-multi-agent-propagation 2026-microsoft-mcp-tool-description-poisoning
- Tags
- multi-agent privilege-escalation cross-agent prompt-injection mcp coding-agents sandbox-escape config-poisoning
Sources
Cite this incident
@misc{2025-cross-agent-privilege-escalation-config-poisoning,
title = {Cross-agent privilege escalation: one coding agent writes another's config files to lift its restrictions},
year = {2025},
howpublished = {agent-postmortems},
url = {https://swarmproof.github.io/agent-postmortems/2025-cross-agent-privilege-escalation-config-poisoning/}
}