Disclosed vulnerability
Amp Code: arbitrary command execution by writing outside the project into VS Code settings
AIR-2025-0078 AIR record · 2025-08-amp-code-config-escape
From the supporting source
Amp uses the user's VS Code configuration file to store settings about allowlisted bash commands the agent can invoke without user approval, and also MCP servers that the agent can use.embracethered.com
The record
Disclosed
2025-08-05
Vendor
Sourcegraph
Product
Amp Code
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent wrote outside the project and got command execution
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection source code
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Amp Code developer workstations
Capability abused
Defense & remediation
Recorded defense
bash command approval and MCP server configuration
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
fixed within days of the early-July 2025 report
Taxonomy & references
Curator notes
Month of AI Bugs 2025.
Supporting sources
Cite as
Enkrypt AI. "Amp Code: arbitrary command execution by writing outside the project into VS Code settings". AIR, AIR-2025-0078. https://agentincident.vercel.app/i/AIR-2025-0078/ (accessed 2026-10-19).