# Cross-Agent Privilege Escalation: When Agents Free Each Other

Indirect prompt injection hijacks Copilot to write malicious MCP config and instructions for Claude Code, which then executes arbitrary code and can reciprocally free Copilot.

- Payout: Research
- Severity: high
- Program: GitHub
- Write-up by: Johann Rehberger
- Disclosed: 2025-09-24
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/cross-agent-privilege-escalation-agents-that-free-each-other/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other
- Tags: area:ai domain:ai impact:privesc impact:rce kind:research platform:research sev:high tech:llm technique:chained vuln:misconfiguration vuln:prompt-injection vuln:rce

**Target:** AI coding agents (GitHub Copilot, Claude Code) config files in VS Code workspace
**Root cause:** Agents write to files without user approval, including other agents' config/instruction files (.mcp.json, .claude/settings.local.json, CLAUDE.md, AGENTS.md), so one agent can inject MCP servers or allowlisted commands that another agent later trusts and executes.
**Steps:**
1. Indirect prompt injection in untrusted data hijacks GitHub Copilot.
2. Copilot writes malicious MCP server entry to Claude's `~/.mcp.json` or `.mcp.json`, and/or injects instructions into `CLAUDE.md`/`AGENTS.md`.
3. Developer opens Claude Code on same codebase; it loads modified config and runs attacker code / allowlisted shell commands.
4. Optionally Claude writes back to Copilot's `.vscode/settings.json` or `.vscode/mcp.json`, closing the loop.
**How found:** Observed that after prior disclosures vendors blocked agents overwriting their own config, but agents still freely create/write other files and folders — including other agents' config and instruction files — suggesting cross-agent config poisoning.
**Exploitation:** Attacker plants indirect prompt injection in content Copilot ingests; Copilot (lacking write approval) creates/modifies Claude Code's MCP config to add a malicious server or allowlists commands, achieving RCE when the developer next runs Claude Code; chain can loop back to Copilot.
**Escalation:** Single prompt injection escalates to multi-agent compromise loop where agents repeatedly reconfigure each other, raising privilege and persistence.
**Insight:** When a vendor patches self-config overwrite, test whether the agent can still write *other* agents' config/instruction files (.mcp.json, CLAUDE.md, AGENTS.md, .gemini/settings.json) in the same workspace — the trust boundary is per-agent, not per-workspace.