Security researchers have uncovered a serious vulnerability in AWS Kiro, the company's AI-powered coding IDE, that could allow a seemingly harmless web page to manipulate the application's configuration and execute attacker-controlled code on a developer's machine.
Researchers from Intezer, working alongside Kodem Security, discovered that a simple request such as asking Kiro to summarize a webpage could trigger a chain of events leading to remote code execution (RCE). AWS has since addressed the issue, although no CVE identifier has been assigned.
How the Attack Circumvented Kiro's Security Model
Kiro's security architecture is designed around human approval. The AI agent can perform powerful actions, including editing files, running shell commands, and accessing external resources, but potentially risky operations are expected to require explicit user consent.
The vulnerability effectively bypassed that protection.
At the center of the issue was a configuration file called mcp.json, located within Kiro's settings directory. This file controls which Model Context Protocol (MCP) servers Kiro can load and specifies the commands used to launch them.
Whenever the file changes, Kiro automatically reloads the configuration and starts any newly defined MCP servers. Researchers found that Kiro's built-in file-writing capability could modify this configuration file without requiring meaningful user approval. This created an opportunity for attackers to inject malicious server entries containing arbitrary operating system commands.
Once the modified configuration was reloaded, the attacker's code would execute automatically under the privileges of the developer using the system.
Hidden Instructions Embedded in a Web Page
To demonstrate the attack, researchers embedded malicious instructions within a legitimate-looking documentation page. The commands were concealed using tiny white text that remained effectively invisible to human visitors but could still be interpreted by Kiro when processing the webpage.
From the developer's perspective, the page appeared to contain ordinary API documentation.
Behind the scenes, however, Kiro interpreted the hidden instructions as operational tasks, modified its own configuration file, registered a rogue MCP server, and triggered execution of the attacker's payload.
The entire compromise could occur after something as routine as asking the assistant to review or summarize online documentation.
From Configuration Manipulation to Code Execution
In the proof-of-concept demonstration, the malicious payload was intentionally limited to periodically transmitting basic system information such as:
- Hostname
- Username
- Operating system details
The researchers configured the callback to communicate only with localhost to avoid impacting real users.
However, they emphasized that the same attack technique could easily be adapted to perform far more damaging actions, including:
- Stealing source code
- Exfiltrating API keys and credentials
- Harvesting cloud access tokens
- Installing persistent malware
- Accessing internal development systems
- Executing arbitrary operating system commands
Although the attack was not perfectly reliable due to the non-deterministic nature of AI models, researchers reported successful exploitation within one or two attempts during testing. As with most security vulnerabilities, a single successful execution is all an attacker requires.
Approval Prompts Failed to Prevent the Attack
Researchers observed that Kiro occasionally displayed a notification indicating that MCP settings had changed and requested user approval.
However, this safeguard proved ineffective.
According to the findings, Kiro reloaded the modified configuration regardless of whether the user approved or rejected the prompt. Consequently, the warning served little practical security purpose because the malicious code execution occurred independently of the user's choice.
In reality, the only action explicitly approved by the developer was allowing Kiro to access the webpage.
A Recurring Security Theme
This was not the first time researchers identified security concerns involving Kiro's configuration files.
On the platform's launch day in 2025, security researcher Johann Rehberger demonstrated a similar attack pathway in which prompt injection techniques modified MCP-related settings and triggered code execution.
Additional concerns were raised regarding the ability to alter Visual Studio Code configuration files that could authorize shell command execution.
AWS subsequently introduced additional prompts and protections, but those mitigations primarily affected supervised operating modes. The vulnerability uncovered by Intezer remained exploitable through Kiro's default autonomous workflow configuration.
Researchers later identified related issues involving automatic execution of malicious tasks stored in Visual Studio Code configuration files when projects were opened. One such vulnerability ultimately received CVE-2026-10591 and was patched by AWS.
AWS Strengthens Protection Mechanisms
In response to the latest findings, AWS implemented a more robust security approach.
Rather than relying solely on the AI model's decision-making or user prompts, Kiro now treats several sensitive files and locations as protected resources requiring mandatory approval before modification.
Protected locations now include:
mcp.json.vscode/tasks.json.gitdirectories- Other security-sensitive configuration files
This protection is enforced at the platform level and applies regardless of whether Kiro is operating in autonomous or supervised modes.
AWS also introduced broader permission controls within newer releases, requiring developers to explicitly grant access before Kiro can perform sensitive actions.
According to the researchers, the attack chain was no longer successful after testing patched versions, including Kiro v0.11.130 and later releases.
No CVE Assigned Despite Security Impact
Intezer reported the vulnerability to AWS through HackerOne in February 2026. AWS subsequently released a fix, and researchers later verified remediation independently.
Despite the potential risk associated with arbitrary code execution, no CVE identifier has been issued, and AWS has not publicly released a comprehensive list of affected versions.
Researchers also noted that their investigation focused primarily on the desktop Kiro IDE and did not determine whether related Kiro CLI or web-based products were impacted.
The Bigger Picture for AI Development Tools
The Kiro vulnerability highlights a broader challenge facing AI-powered coding assistants and agentic development environments.
Over the past year, multiple researchers have identified similar classes of vulnerabilities affecting popular developer tools, including platforms from major vendors. Many of these issues stem from the ability of AI agents to modify configuration files, execute commands, or act upon untrusted content originating from the web.
The central lesson emerging from these incidents is that security controls must be enforced by the platform itself rather than relying entirely on user approval dialogs or AI judgment. As coding assistants gain deeper access to development environments, organizations must ensure that critical safeguards remain outside the influence of prompts, model behavior, and untrusted inputs.
In the case of AWS Kiro, the eventual fix reflects that principle: meaningful protection comes from hard security boundaries that cannot be altered simply because an AI agent was convinced to do so.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
