Amp Code: Arbitrary Command Execution via Prompt Injection Fixed
Brief
Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files.
That was the case with Amp , an agentic coding tool built by Sourcegraph .
The AI coding agent could update its own configuration and:
- Allowlist bash commands or
- Add a malicious MCP server on the fly to run arbitrary code
This could have been exploited by the model itself, or during an indirect prompt injection attack as we will demonstrate in this post.