A critical vulnerability in AWS’s agentic IDE Kiro lets attackers hide malicious instructions inside ordinary web pages, tricking the AI agent into rewriting its own configuration file and executing arbitrary code on a developer’s machine without any suspicious approval prompt ever appearing.
Kiro ships with tools that let the AI act autonomously, including web fetching, shell execution, and management of Model Context Protocol (MCP) servers, whose settings live in a file at ~/.kiro/settings/mcp.json.
Nicole Fishbein found this file was not on Kiro’s list of protected paths, meaning the agent could write to it using its built-in file-editing tool without triggering a human approval step, even though writing to most other sensitive files requires explicit user sign-off.
AWS Kiro IDE Flaw
An attacker only needed to embed invisible instructions, styled in white, one-pixel text, into a page that looked like ordinary documentation.
When a developer asked Kiro to fetch and summarize that page, a routine and approved action, the model also parsed the hidden text and quietly registered a new “telemetry” MCP server whose startup command executed attacker-controlled Node.js code.
According to Nicole Fishbein, Kiro automatically reloads mcp.json whenever it changes; the malicious server launched immediately, giving the attacker code execution with the victim’s own privileges.
The core issue is that Kiro’s “human-in-the-loop” safety model, requiring user approval for risky actions like shell commands or unfamiliar file writes, did not extend to the one file that determines what code the agent will ultimately run.
Even when Kiro displayed a warning that the MCP configuration had changed, the file reloaded regardless of the user’s response, offering no real protection.
Security researcher Johann Rehberger previously reported a related indirect prompt injection flaw in Kiro on the day of its July 2025 release, which AWS patched within weeks without issuing a CVE.
AWS separately disclosed another Kiro flaw, tracked as CVE-2026-4295, involving arbitrary code execution through maliciously crafted project files, patched in version 0.8.0.
The flaw affected Kiro versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) and was reported to AWS in February 2026. AWS confirmed a fix had shipped by early April, and Nicole Fishbein verified the patch in version 0.11.130.
AWS separately published a security bulletin addressing broader prompt injection issues across Kiro and Amazon Q Developer IDE plugins, recommending users upgrade to Language Server v1.24.0.
The case underscores a structural problem with agentic coding tools: because large language models cannot cleanly separate data from instructions, any content an agent reads, from search results to API responses, can potentially hijack its behavior.
Nicole Fishbein argues that trust boundaries for high-risk actions must be enforced at the platform level, independent of model judgment, since prompt injection remains an unsolved class of vulnerability across AI coding assistants.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
