Research demo
AgentHopper: a universal prompt-injection payload that hops between shipped coding agents
AIR-2025-0128 AIR record · 2025-08-agenthopper-ai-virus
From the supporting source
The idea was to have one prompt injection payload that would operate across agents and exploit them accordingly.embracethered.com
The record
Disclosed
2025-08-29
Vendor
GitHub/Microsoft; Amazon/AWS; Sourcegraph
Product
GitHub Copilot; Amazon Q Developer; AWS Kiro; Amp Code
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the payload made each agent write config and execute, hopping onward
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection repo content
Impact type
Code execution, Self propagation, Persistence, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
developer machines and any Git project the infected agent touches
Capability abused
Defense & remediation
Recorded defense
per-agent approval gates and configuration protections
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
all targeted vulnerabilities patched by the vendors
Taxonomy & references
Curator notes
Johann Rehberger, 29 Aug 2025. One payload fingerprints which coding agent is reading it and fires the matching exploit (e.g. writing chat.tools.autoApprove into .vscode/settings.json for Copilot, a fake MCP server config for Amp Code). Research PoC; the article does not indicate the code was released. This is the clearest cross-vendor agent-virus demonstration against shipped products prior to the 2026 OpenClaw worm wave. | Merged from duplicate id `2025-08-embracethered-agenthopper`. Also reported as: 'AgentHopper: a proof-of-concept AI virus that self-propagates across coding agents via prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "AgentHopper: a universal prompt-injection payload that hops between shipped coding agents". AIR, AIR-2025-0128. https://agentincident.vercel.app/i/AIR-2025-0128/ (accessed 2026-10-19).