# AgentHopper: An AI Virus

Universal conditional prompt-injection payload self-propagates across coding agents (Copilot, Amp, Amazon Q, Kiro), achieving RCE and pushing infected commits to GitHub repos.

- Payout: Research
- Severity: high
- Program: GitHub
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-30
- CVE: CVE-2025-53773
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2025/agenthopper-a-poc-ai-virus/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus
- Tags: area:ai domain:ai impact:integrity impact:rce kind:research platform:research sev:high tech:llm technique:chained technique:source-review vuln:prompt-injection vuln:rce

**Target:** AI coding agents (VS Code extensions/CLI) and Git repositories
**Root cause:** Coding agents can modify their own configuration (settings.json, MCP config, allowlists) and execute commands, so an indirect prompt injection in a repo file can flip the agent into YOLO mode or register a malicious MCP server and run arbitrary code.
**Steps:**
1. Inject conditional prompt payload at top of a source file in a Git repo, branching on agent identity (Copilot/Amp/Amazon Q/Kiro).
2. Copilot path: instruct agent to write `settings.json` enabling YOLO/auto-approve, then download and run AgentHopper binary.
3. Amp path: instruct agent to add a fake MCP server entry pointing to a Python program that downloads and runs AgentHopper.
4. Amazon Q path: instruct agent to run `find ... -exec` to download and execute AgentHopper.
5. Kiro path: instruct agent to edit config to allowlist all bash commands, then download and run AgentHopper.
6. AgentHopper scans local Git repos, injects the payload, commits and pushes to GitHub to infect other developers.
**How found:** Prior Month of AI Bugs RCE-via-prompt-injection findings in multiple agents prompted the hypothesis that a single conditional payload could target each agent's specific config/exec primitive and self-propagate like a floppy-disk virus.
**Exploitation:** Attacker plants indirect prompt injection in a repo/file; victim's agent processes it, self-modifies config to gain command execution, downloads AgentHopper, which then infects and pushes to the victim's other repos, hopping to the next developer who pulls the code.
**Escalation:** Propagation loop: each compromised agent infects additional repos and pushes to GitHub, spreading to other agents/developers (worm-like).
**Insight:** Agents that can write their own config (settings.json, MCP server lists, command allowlists) turn a benign-looking repo file into RCE; craft conditional payloads that branch on agent identity to hit each agent's specific self-configuration primitive.