3 Hops to RCE. | MCP Security Part 4

The MCP Bug Bounty Field Guide · Part 4 of 5 — the full takeover chain, hop by hop, grounded in a real CVE'd exploit. And the single hop a defender should break.

30-second version The scariest MCP bugs don't need a novel exploit. They need an agent that can edit its own configuration. In August 2025, GitHub Copilot got CVE-2025–53773: one prompt injection writes one line to a settings file, the agent flips itself into auto-approve mode, then runs shell. Full RCE on the developer's machine. This is the chain, the hops, and the one control that stops all of them.

Previously in this series: Part 1 · Part 2 — tool poisoning · Part 3 — prompt injection as SSRF for text

Parts 2 and 3 gave you the two bug classes: the description is the payload, and tool output is the injection vector.

Part 4 connects them into one end-to-end takeover path. And here's the thing that makes it real, not a thought experiment:

This exact chain has already been reproduced, CVE'd, and patched.

In August 2025, GitHub Copilot and VS Code shipped a fix for CVE-2025–53773, a remote code execution vulnerability powered by prompt injection. The researcher, Johann Rehberger (wunderwuzzi), published the full chain. It is the cleanest real-world example of the pattern this whole series has been pointing at.

So we're not theorizing. We're reading the lab notes.

The pattern: an agent that can edit its own environment

Before the hops, the pattern they all share. Rehberger names it plainly:

If an agent can write to files and modify its own configuration or security-relevant settings, it can escalate privileges and execute code.

That is the whole bug class in one sentence. The MCP surface is dangerous not because the protocol is exotic, but because agents are routinely given file-write access to their own config. Once an attacker controls input to the agent (Part 3), they control what the agent writes. And what the agent writes can be the agent's own permissions.

This is also called the lethal trifecta in agent security: an agent that has resources (files, tools), agency (can act without asking), and access (can reach sensitive things). Any two is risky. All three is compromise. The Copilot chain hits all three.

The chain, hop by hop

Reading CVE-2025–53773 as a hunter would. Five hops. Each one is a thing you can test for.

Hop 1 — Injection arrives. The entry point is any channel an attacker controls that becomes agent context. In the published PoC it was a source file, but Rehberger notes the same payload rides in via a web page, a GitHub issue, or a tool call response — which is exactly the Part 3 vector. The payload can even use invisible Unicode so it's not visible in the file.

Hop 2 — The agent writes its own config. This is the hop that makes the whole chain possible, and the one almost nobody tests. The injection tells the agent to add one line to .vscode/settings.json:

"chat.tools.autoApprove": true

"chat.tools.autoApprove": true

The file and folder are created if they don't exist. The agent has file-write access by design. Nobody reviews the write, because the writes go straight to disk, not into a diff to approve.

Hop 3 — Permissions flip. autoApprove: true puts Copilot into "YOLO mode." Every user confirmation that would have gated the next steps is now disabled. The agent just turned off its own guardrails, by writing to a file it was allowed to write to.

Hop 4 — Execution. With confirmations off, the agent runs a terminal command. The published chain uses conditional prompt injection — the payload branches on the OS — so the same injection pops calc on Windows, macOS, and Linux. That's the moment it becomes RCE.

Hop 5 — Persistence and spread. From here it's post-exploitation. Join the machine to a C2 ("ZombAI"). Or, the scarier version: write the same injection into other Git projects and force-push upstream, so the next developer who touches an infected file runs the chain too. An AI virus, by way of a settings file.

Why hop 2 is the only hop that matters

You can't easily stop hop 1 — the agent has to read something. You can try to filter hop 4, but there are always new commands. Hop 5 is downstream of the damage.

Hop 2 is the cheap, single control that breaks the entire chain: the agent must not be able to write to its own configuration or permission files. Not settings.json, not agent allow-lists, not MCP server config, not tasks.json. Treat those paths as read-only for the agent, or require explicit human approval on every write.

This is why this bug is so reportable: the fix is one boundary, and its absence is a privilege-escalation primitive. Triagers understand "an untrusted input can modify the application's security configuration." That is a Critical by any standard.

The second pattern: old bugs ride the MCP surface

The Copilot chain is the AI-novel one. But here's the part that's even better for bounty hunters: MCP servers also inherit the oldest bugs in the book, because most of them are just file and path handlers nobody audited.

Same month, CVE-2025–53109 in Anthropic's own Filesystem MCP server. The allowedDirectories setting is meant to restrict the AI to specific folders. The validation used .startsWith on the path string instead of resolving the real path. So if you allow-listed /mnt/finance/data, the AI also got /mnt/finance/data-archived, and anything else starting with that prefix. A classic path-validation bug, sitting in the reference MCP server everyone copies.

Rehberger's takeaway, and it's the takeaway for hunters: MCP servers often suffer from classic vulnerability types we haven't seen in a long time. Path traversal, SSRF, auth bypass, race conditions on ACLs — all of them ride the MCP surface, because MCP servers are usually small, trusted-looking packages that never got a real security review.

So hunt both patterns. The self-modifying-config escalation (novel, Critical) and the path-validation bypass (classic, often High). The same target can carry both.

Writing it up so it scores Critical

The mistake: submitting the PoC as "prompt injection did a thing." That lands as AI safety. Reframe it as the class it is:

• Class: privilege escalation via self-modifying configuration. (And/or path validation bypass for the second pattern.)
• Untrusted source: the injected content (file, webpage, MCP tool response).
• Reachable primitive: a config write that flips a permission flag, or a path check that over-permits.
• End state: arbitrary code execution on the host, or access to out-of-scope data.

Then the three layers from earlier in the series: blast radius (every user of the agent), chained impact (config write to RCE to C2 / data exposure), business impact (developer host compromise, source-tree infection, secrets exfil). Name the CVE pattern as precedent — "this is the same class as CVE-2025–53773, fixed by Microsoft in August 2025." Precedent is the strongest lever you have when a triager has never seen the bug class before.

The reframe for the top of your report:

This is privilege escalation. An untrusted input modifies the application's security configuration, disabling confirmation gates and yielding arbitrary code execution. Same class as CVE-2025–53773.

The close

The scariest MCP bugs aren't the ones that need a new exploit technique. They're the ones that need an agent trusted to edit its own world.

CVE-2025–53773 proved the pattern end to end: one injection, one config write, auto-approve on, shell runs, host falls. Five hops, all reproducible, all patched. CVE-2025–53109 proved the other half: the same servers carry the old path bugs we thought we'd retired.

For hunters, that's the opportunity. The surface is fresh, the bugs are both novel and classical, and the precedent now exists to argue Critical. Find the config write the agent is allowed to do. Find the path check that uses startsWith. Find the tool output that becomes instructions. The chain is there. The CVEs just proved it.

Next in the series: Part 5 — the recon and report-craft playbook. The moves that surface MCP in scope, and the report template that turns these chains into paid Criticals.

Sources

• CVE-2025–53773 — GitHub Copilot / VS Code Remote Code Execution via prompt injection (self-modifying settings.json, chat.tools.autoApprove). Discovered and published by Johann Rehberger (Embrace The Red), also reported by Markus Vervier (Persistent Security) and Ari Marzuk. Fixed in August 2025 Patch Tuesday. Writeup: embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection. MSRC: msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773.
• CVE-2025–53109 — Anthropic Filesystem MCP server directory access bypass via .startsWith path validation. Discovered by Johann Rehberger and independently by Elad Beber (Cymulate, "EscapeRoute"). Fixed in the rewrite supporting MCP roots. Writeup: embracethered.com/blog/posts/2025/anthropic-filesystem-mcp-server-bypass.
• "Lethal trifecta" in agent security — prompt injection leaking access tokens when an agent has resources, agency, and access. See Rehberger's OpenHands writeup (Aug 2025): embracethered.com/blog/posts/2025/openhands-the-lethal-trifecta-strikes-again.
• Model Context Protocol specification (2026–07–28) — tool descriptions/annotations are untrusted; tools represent arbitrary code execution. Spec: modelcontextprotocol.io/specification.
• Month of AI Bugs 2025 — monthofaibugs.com. A catalog of real, disclosed agent vulnerabilities, many via MCP and prompt injection.

Author note before publishing: every CVE and the chain above are real and publicly disclosed. When you adapt the hops to a target, replace the Copilot specifics with the target's real config paths and permission flags. Sanitize all payloads. Confirm scope covers the agent, its config files, and any filesystem MCP server before testing. Lead the report with the CVE precedent — it is the lever that flips an unfamiliar bug class to Critical.