Hidden textual content on an internet web page was sufficient to make Kiro, AWS’s agentic coding IDE, rewrite its personal configuration file and run an attacker’s code on a developer’s machine, with no approval step in a position to cease it.
Intezer, in analysis with Kodem Safety, discovered {that a} request as bizarre as asking Kiro to summarize a web page might finish in distant code execution. AWS has patched the problem, and no CVE has been assigned to it.
Kiro’s security mannequin rests on a human clicking “enable.” The agent can run shell instructions, fetch URLs, and edit information, and the design assumes a developer critiques something dangerous earlier than it occurs. That approval step is the safety boundary, and the flaw let an attacker slip previous it with out the developer ever being supplied a selection.
The weak level was the file that tells Kiro which exterior instruments to load. Kiro reads its listing of Mannequin Context Protocol servers, and the precise command used to begin every one, from ~/.kiro/settings/mcp.json.
When that file modifications, Kiro reloads it and launches no matter it describes, on the host, with the developer’s privileges. On the time of the analysis, Kiro might write to mcp.json by itself with its fsWrite software, no approval required, and reload it routinely.
Anybody who might affect the contents of that file might register a server whose begin command was arbitrary code, and it might run the second Kiro reloaded.
Getting textual content into Kiro’s context is the straightforward half. The agent pulls in outdoors content material every time a developer asks it to fetch a URL, learn documentation, or search the net. Intezer’s proof of idea planted its directions in one-pixel white textual content (shade:#fff;font-size:1px) on an in any other case bizarre API documentation web page.
The developer sees a clear API reference. Kiro reads the hidden block as a setup activity, writes the malicious server into mcp.json, and reloads. Inside seconds, the rogue server begins, and the attacker’s code is operating.
In Intezer’s demo, the payload solely phoned house with the machine’s hostname, username, and platform each ten seconds, simply sufficient to show execution. The identical primitive might run any command out there to the developer, sufficient to steal credentials and supply code, plant persistence, or pivot into no matter inside techniques they will attain.
The researchers saved their callback pointed at localhost so no actual Kiro customers have been uncovered, they usually word the assault will not be completely dependable: the mannequin is non-deterministic and will summarize the web page and ignore the hidden block. Of their testing, it labored inside one or two tries. One success is all it takes.
Kiro did, in some circumstances, present a pop-up saying the MCP configuration had modified and asking for approval. It made no distinction. The configuration reloaded no matter what the developer clicked, so the warning supplied no actual safety. The one motion the developer ever really authorised was fetching a URL.
Kiro had been right here earlier than
An agent in a position to write the file that governs what it’s allowed to run has surfaced in Kiro earlier than. On Kiro’s launch day in July 2025, Johann Rehberger of Embrace The Crimson confirmed the identical mcp.json write-to-execution transfer: a immediate injection dropped customized code into an MCP settings file and ran it the second the file saved.
He flagged a second route too, writing to .vscode/settings.json to allowlist shell instructions. AWS’s response, Kiro 0.1.42, added an approval immediate for these writes, however solely in Supervised mode. The default Autopilot mode saved writing the file by itself, and that’s the mode. Intezer’s 2026 chain used. No CVE was issued then both.
Others discovered neighboring variations of the identical class. Cymulate reported that Kiro would auto-execute code written to .vscode/duties.json when a folder was opened. AWS assigned it CVE-2026-10591 (8.8 beneath CVSS 3.1, 8.6 beneath CVSS 4.0) and glued it within the 0.11 collection.
Intezer’s mcp.json chain was nonetheless stay on variations 0.9.2 (macOS) and 0.10.16 (Ubuntu) when the corporate reported it in February 2026, and was confirmed patched in v0.11.130.
AWS’s reply was to cease trusting the mannequin’s judgment on these information and transfer the test into the platform. Kiro now marks mcp.json, .vscode/duties.json, the .git listing, and different delicate information as protected paths, every requiring express approval earlier than a write.
Its personal documentation makes the purpose straight: “Supervised mode is a code evaluate workflow, not a safety management.” The 1.0 launch that adopted leans more durable on the identical precept, with a capability-based permissions mannequin that prompts for consent on something a developer has not already allowed.
That mixture closes the route Intezer took: Intezer confirmed the assault failed in 0.11.130, and, in contrast to the 2025 repair, the protected-paths test holds in each Autopilot and Supervised mode.
Intezer reported the flaw via HackerOne on February 11, 2026, and by April 3 AWS stated the repair had shipped in its newest launch, although it by no means named the model; the researchers confirmed it themselves in v0.11.130.
No CVE has been assigned: The Hacker Information discovered none for the discovering within the Nationwide Vulnerability Database as of July 21, 2026, and AWS revealed no full listing of affected builds. Intezer reported no in-the-wild exploitation, and its testing coated Kiro IDE; it didn’t set up whether or not the separate Kiro CLI or Internet builds shared the flaw.
Present builds are on the 1.0.x line, with 1.0.165 listed as the newest as of July 21, 2026, and anybody on an older model ought to replace from Kiro’s downloads web page.
The Hacker Information has reached out to AWS for affirmation of the affected Kiro variations and why no CVE was assigned, and can replace this story with any response.
Over roughly a yr, three separate analysis efforts discovered the identical form of bug in Kiro: an agent quietly enhancing the information that determine what it’s allowed to execute. Kiro will not be alone: in December 2025, researchers catalogued greater than 30 flaws throughout AI coding instruments, Cursor and Copilot amongst them, all turning respectable editor options into prompt-injection paths to code execution or information theft.
The present fixes all level to the identical lesson: the management that works sits within the platform, enforced in each mode and out of doors something the mannequin might be instructed to vary.
As extra of the event workflow strikes to brokers that learn the open net, a human within the loop solely works as a management if the human is proven the step that issues, and the platform holds the road even after the mannequin has been fully talked into crossing it.
