{
 "public_id": "AIR-2025-0078",
 "incident_id": "2025-08-amp-code-config-escape",
 "date_disclosed": "2025-08-05",
 "date_occurred": null,
 "title": "Amp Code: arbitrary command execution by writing outside the project into VS Code settings",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_source_code",
 "agent_capability_abused": [
  "file_write",
  "config_modification",
  "shell_command_execution",
  "mcp_tool_invocation"
 ],
 "target_product": "Amp Code",
 "target_vendor": "Sourcegraph",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution"
 ],
 "blast_radius": "Amp Code developer workstations",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "config_poisoning",
   "allowlist_abuse",
   "mcp_injection",
   "sandbox_escape"
  ]
 },
 "defense_present": "bash command approval and MCP server configuration",
 "defense_bypassed": true,
 "fix_shipped": "fixed within days of the early-July 2025 report",
 "primary_sources": [
  "https://embracethered.com/blog/posts/2025/amp-agents-that-modify-system-configuration-and-escape/"
 ],
 "verified_quote": "Amp uses the user's VS Code configuration file to store settings about allowlisted bash commands the agent can invoke without user approval, and also MCP servers that the agent can use.",
 "confidence": "high",
 "notes": "Month of AI Bugs 2025.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Prompt Injection",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent wrote outside the project and got command execution",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_source_code",
 "guardrail_kind": [
  "human_approval"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "amp",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}