Analysis · curated 11 Aug 2026

3 Hops to RCE. | MCP Security Part 4

First reported today medium.com

Coverage timeline

Single-source analysis — first reported, latest, and curated coincide.

Why it matters

CVE-2025-53773 demonstrates that an AI agent able to edit its own configuration can be steered by a prompt injection into self-approving actions and achieving code execution, a pattern defenders must guard against across MCP-enabled assistants.

Part 4 of an MCP security series by Abhishek meena walks through the full takeover chain behind CVE-2025-53773, a remote code execution flaw in GitHub Copilot and VS Code patched in August 2025 and originally documented by researcher Johann Rehberger. The write-up explains how a single prompt injection writes one line to a settings file, flips the agent into auto-approve mode, then executes shell commands for full RCE on the developer's machine.