Model Context Protocol

Johann Rehberger describes a design flaw in agentic systems that lets one coding agent rewrite another agent's configuration, freeing it from its sandbox. In his demo, a prompt-injected GitHub Copilot writes a malicious MCP server into Claude Code's config, which then runs arbitrary code. The post notes that Claude can reciprocate by modifying Copilot's configuration.

Researcher Johann Rehberger reported that AWS Kiro, a coding agent, can be hijacked through indirect prompt injection to run arbitrary operating system commands. An attacker who controls data Kiro processes can make it write to .vscode/settings.json and add "kiroAgent.trustedCommands": ["*"], allowlisting all Bash commands without developer approval. A second path adds malicious MCP servers through .kiro/settings/mcp.json. The proof of concept opened the Calculator app and changed the VS Code color theme with no user interaction beyond a chat prompt.

A researcher shows that Deep Research agents in ChatGPT can leak data between connected tools, since all connectors and MCP servers share one trust boundary. Data from one source, such as Outlook email, can be used in queries sent to another source, such as a custom Remote Matrix MCP server, and an attacker can force this through prompt injection. The custom connector must implement exactly search and fetch, and the research was conducted about two months before publication.

Researcher Johann Rehberger describes an attack chain against Amp, an agentic coding tool built by Sourcegraph, in which the agent could write to the user's VS Code settings.json file outside the project folder without approval. An attacker, or the model itself through indirect prompt injection, could add wildcard or malicious entries to the allowlisted bash commands or add a malicious MCP server, achieving arbitrary code execution on the developer's machine. The issue was reported to Sourcegraph and fixed within a few days.

A researcher found that Anthropic's filesystem MCP server validates allowed paths with a .startsWith comparison in the validatePath function of index.ts, without checking that the path is a directory. As a result, a directory allowlisted through allowedDirectories, such as /mnt/finance/data, also grants access to sibling paths sharing the same prefix, such as /mnt/finance/data-archived. The researcher reported the issue to Anthropic on June 1, 2025, and Elad Beber had independently reported it earlier.

A security advisory reports a data leakage and exfiltration vulnerability in Anthropic's Slack MCP Server, a reference implementation now deprecated and unmaintained. The server does not disable link unfurling when posting to channels, so an AI agent that posts links can leak data, such as secrets from a .env file, to third-party servers, and a prompt injection can trigger this. The advisory says the server appears widely used, with 14k+ weekly downloads.

The author explains that the Model Context Protocol (MCP) lets LLM apps and agents discover and use external tools at runtime, unlike static setups such as OpenAPI. The author argues that because of prompt injection, MCP tool servers effectively control the client. The post promises a detailed explanation and a novel exploit chain.