Hidden text on a web page was enough to make Kiro, AWS’s agentic coding IDE, rewrite its own configuration file and run an attacker’s code on a developer’s machine, with no approval step able to stop it.
Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been assigned to it.
Kiro’s safety model rests on a human clicking “allow.” The agent can run shell commands, fetch URLs, and edit files, and the design assumes a developer reviews anything risky before it happens. That approval step is the security boundary, and the flaw let an attacker slip past it without the developer ever being offered a choice.
The weak point was the file that tells Kiro which external tools to load. Kiro reads its list of Model Context Protocol servers, and the exact command used to start each one, from ~/.kiro/settings/mcp.json.
When that file changes, Kiro reloads it and launches whatever it describes, on the host, with the developer’s privileges. At the time of the research, Kiro could write to mcp.json on its own with its fsWrite tool, no approval required, and reload it automatically.
Anyone who could influence the contents of that file could register a server whose start command was arbitrary code, and it would run the moment Kiro reloaded.
Getting text into Kiro’s context is the easy part. The agent pulls in outside content whenever a developer asks it to fetch a URL, read documentation, or search the web. Intezer’s proof of concept planted its instructions in one-pixel white text (color:#fff;font-size:1px) on an otherwise ordinary API documentation page.
The developer sees a clean API reference. Kiro reads the hidden block as a setup task, writes the malicious server into mcp.json, and reloads. Within seconds, the rogue server starts, and the attacker’s code is running.
In Intezer’s demo, the payload only phoned home with the machine’s hostname, username, and platform every ten seconds, just enough to prove execution. The same primitive could run any command available to the developer, enough to steal credentials and source code, plant persistence, or pivot into whatever internal systems they can reach.
The researchers kept their callback pointed at localhost so no real Kiro users were exposed, and they note the attack is not perfectly reliable: the model is non-deterministic and may summarize the page and ignore the hidden block. In their testing, it worked within one or two tries. One success is all it takes.
Kiro did, in some cases, show a pop-up saying the MCP configuration had changed and asking for approval. It made no difference. The configuration reloaded regardless of what the developer clicked, so the warning offered no real protection. The only action the developer ever actually approved was fetching a URL.
Kiro had been here before
An agent able to write the file that governs what it is allowed to run has surfaced in Kiro before. On Kiro’s release day in July 2025, Johann Rehberger of Embrace The Red showed the same mcp.json write-to-execution move: a prompt injection dropped custom code into an MCP settings file and ran it the moment the file saved.
He flagged a second route too, writing to .vscode/settings.json to allowlist shell commands. AWS’s response, Kiro 0.1.42, added an approval prompt for those writes, but only in Supervised mode. The default Autopilot mode kept writing the file on its own, and that is the mode. Intezer’s 2026 chain used. No CVE was issued then either.
Others found neighboring versions of the same class. Cymulate reported that Kiro would auto-execute code written to .vscode/tasks.json when a folder was opened. AWS assigned it CVE-2026-10591 (8.8 under CVSS 3.1, 8.6 under CVSS 4.0) and fixed it in the 0.11 series.
Intezer’s mcp.json chain was still live on versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) when the company reported it in February 2026, and was confirmed patched in v0.11.130.
AWS’s answer was to stop trusting the model’s judgment on these files and move the check into the platform. Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as protected paths, each requiring explicit approval before a write.
Its own documentation makes the point directly: “Supervised mode is a code review workflow, not a security control.” The 1.0 release that followed leans harder on the same principle, with a capability-based permissions model that prompts for consent on anything a developer has not already allowed.
That combination closes the route Intezer took: Intezer confirmed the attack failed in 0.11.130, and, unlike the 2025 fix, the protected-paths check holds in both Autopilot and Supervised mode.
Intezer reported the flaw through HackerOne on February 11, 2026, and by April 3 AWS said the fix had shipped in its latest release, though it never named the version; the researchers confirmed it themselves in v0.11.130.
No CVE has been assigned: The Hacker News found none for the finding in the National Vulnerability Database as of July 21, 2026, and AWS published no complete list of affected builds. Intezer reported no in-the-wild exploitation, and its testing covered Kiro IDE; it did not establish whether the separate Kiro CLI or Web builds shared the flaw.
Current builds are on the 1.0.x line, with 1.0.165 listed as the latest as of July 21, 2026, and anyone on an older version should update from Kiro’s downloads page.
The Hacker News has reached out to AWS for confirmation of the affected Kiro versions and why no CVE was assigned, and will update this story with any response.
Over roughly a year, three separate research efforts found the same shape of bug in Kiro: an agent quietly editing the files that decide what it is allowed to execute. Kiro is not alone: in December 2025, researchers catalogued more than 30 flaws across AI coding tools, Cursor and Copilot among them, all turning legitimate editor features into prompt-injection paths to code execution or data theft.
The current fixes all point to the same lesson: the control that works sits in the platform, enforced in every mode and outside anything the model can be told to change.
As more of the development workflow moves to agents that read the open web, a human in the loop only works as a control if the human is shown the step that matters, and the platform holds the line even after the model has been completely talked into crossing it.
