# Agent self-modifying config and MCP

Can the agent write its own or another agent's trust config, allowlists, or MCP server list?

_Area: AI and LLM app security. Seen in 5 disclosed reports; latest 2025-09-24. Updated 2026-10-23._

## How it works
An agent's trust boundary is defined by files it can also write: command allowlists, auto-approve flags, MCP server definitions, hooks, and instruction files. The design assumes these files are controlled by the developer, but if the agent has file-write access to them (directly, or via injected content it processes), a prompt injection stops being just text and becomes a configuration change. Once the agent edits its own permissions, it can grant itself command execution, register a malicious MCP server, or disable confirmations, and the next action runs with no human in the loop.

## Where it shows up
- Security-relevant config stored in workspace files the agent can write: `settings.json`, `.vscode/settings.json`, `.mcp.json`, `tasks.json`, command allowlists, hooks [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-github-copilot-remote-code-execution-via-prompt-injection.md)
- Auto-approve / YOLO flags such as `chat.tools.autoApprove:true` [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-github-copilot-remote-code-execution-via-prompt-injection.md)
- Agent writes files without developer approval, including outside the project root into user-level config [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)
- Instruction files another agent trusts: `CLAUDE.md`, `AGENTS.md`, `.claude/settings.local.json` [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md)
- Indirect injection sources: repo files, READMEs, issues, tool output the agent reads [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection.md)

## How to review
The invariant: no file that grants the agent permissions, defines its tools/MCP servers, or sets trust for any agent may be writable by an agent acting on untrusted input. Check each config path and ask whether the agent's write scope reaches it. Confirm allowlists and MCP lists live outside agent-writable space, or that writes to them require explicit human approval. Verify the agent cannot write outside the project root into user-level or other agents' config [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md). Treat any auto-approve toggle as a privilege boundary.

## Variants seen
- Self-rewrite of own settings/allowlist to enable command execution [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-github-copilot-remote-code-execution-via-prompt-injection.md)
- Registering a malicious MCP server via injected config [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)
- Self-propagating payload branching on agent identity across multiple coding agents [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus.md)
- Cross-agent escalation: one agent writes another's config/instructions, which the second trusts [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md)

## Why fixes fail
Patching one agent's self-config write does not stop it writing *other* agents' config and instruction files in the same workspace, so escalation persists across the toolchain [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md).

## Impact and severity
Arbitrary code execution on the developer machine and persistence via config; infected commits pushed to shared repos [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus.md). Severity is high because the trust boundary is rewritten silently and survives restarts. Worse when writes need no approval and reach user-level or cross-agent config [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-agenthopper-a-poc-ai-virus.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-agents-that-modify-system-configuration-and-escape.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-github-copilot-remote-code-execution-via-prompt-injection.md
- E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cross-agent-privilege-escalation-agents-that-free-each-other.md