AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

Summary

Security researchers at Intezer, working with Kodem Security, demonstrated that AWS's agentic coding IDE Kiro could be driven to arbitrary code execution through indirect prompt injection: hidden text on a web page fetched by the agent instructed it to rewrite its own Model Context Protocol configuration file (~/.kiro/settings/mcp.json) and reload, launching an attacker-defined server command with the developer's privileges.^[0]

The core weakness is that Kiro's safety model relies on a human approval step that the attack bypassed entirely — the agent could write mcp.json with its fsWrite tool without approval, and any configuration-change warning reloaded regardless of the developer's choice, leaving the URL fetch as the only step ever actually approved.^[0]

This is the third separate research effort over roughly a year to find the same class of flaw in Kiro: Johann Rehberger of Embrace The Red showed the same mcp.json and .vscode/settings.json write-to-execution routes on Kiro's July 2025 release day, and Cymulate reported a related .vscode/tasks.json auto-execution issue tracked as CVE-2026-10591. AWS has patched the Intezer chain (confirmed in v0.11.130) by enforcing protected paths at the platform level, with no CVE assigned and no in-the-wild exploitation reported.^[0][15]

Attack chain

1. Injection delivery: An attacker embeds malicious instructions in one-pixel white text (color:#fff;font-size:1px) on an otherwise ordinary API documentation web page; the developer sees a clean reference.^[0]
2. Context ingestion: The developer asks Kiro to perform an ordinary task such as summarizing or fetching the page, pulling the hidden instructions into the agent's context — the only step the developer explicitly approves is fetching the URL.^[0]
3. Configuration tampering: Kiro interprets the hidden block as a setup task and uses its fsWrite tool to write a malicious MCP server, whose start command is arbitrary code, into ~/.kiro/settings/mcp.json without requiring approval.^[0]
4. Execution: Kiro automatically reloads mcp.json and launches the rogue server on the host with the developer's privileges; any configuration-change pop-up reloads regardless of the developer's response. Intezer's demo payload beaconed hostname, username, and platform every ten seconds to prove execution.^[0]

Disclosure timeline

How it works

Kiro loads its Model Context Protocol servers and the exact commands used to launch each one from ~/.kiro/settings/mcp.json. When that file changes, Kiro reloads it and starts whatever it describes on the host with the developer's privileges. Because Kiro could write to mcp.json with its fsWrite tool without approval and auto-reload, anyone who could influence the file's contents could register a server whose start command was arbitrary code that ran the moment Kiro reloaded.^[0]

The agent ingests untrusted external content whenever a developer asks it to fetch a URL, read documentation, or search the web. Instructions hidden in near-invisible one-pixel white text on a documentation page were read by Kiro as a legitimate setup task, driving the mcp.json write. The approval boundary failed because any configuration-change pop-up reloaded the file regardless of the response; the model is non-deterministic and may ignore the hidden block, but Intezer's testing succeeded within one or two tries.^[0]

The 2025 Embrace The Red research established the same underlying primitive: Kiro can write files without developer consent, allowing an indirect prompt injection to allowlist all Bash commands by adding "kiroAgent.trustedCommands": ["*"] to .vscode/settings.json, or to add malicious MCP servers to .kiro/settings/mcp.json, both leading to arbitrary command execution.^[15]

Affected versions and patch status

Key takeaways

• Over roughly a year, three independent research efforts (Embrace The Red, Cymulate, and Intezer) found the same shape of flaw in Kiro: an agent quietly editing the very files that decide what it is allowed to execute, turning benign editor features into prompt-injection paths to code execution.^[0][15]
• A human-in-the-loop control only works if the human is shown the step that matters; the effective fix is platform-enforced protection of sensitive paths in every mode, not model-side judgment the attacker's injected text can override.^[0]
• The flaw was patched with no CVE assigned and no in-the-wild exploitation reported, but the researchers noted a single successful injection — achieved within one or two tries despite the model's non-determinism — is enough to fully execute.^[0]

Defensive actions

• Update Kiro to a patched build (v0.11.130 or later, current 1.0.x line) from Kiro's downloads page.: The mcp.json indirect-prompt-injection chain was confirmed patched in v0.11.130, and the protected-paths control holds in both Autopilot and Supervised mode, unlike the earlier Supervised-mode-only fix.^[0]
• Do not rely on Supervised mode or agent approval pop-ups as a security control against configuration-file writes.: Kiro's own documentation states "Supervised mode is a code review workflow, not a security control," and the vulnerable approval pop-up reloaded the configuration regardless of the developer's choice.^[0]
• Treat any agent-writable file that governs execution (mcp.json, .vscode/tasks.json, .vscode/settings.json, .git) as a platform-enforced protected path requiring explicit approval.: AWS's effective remediation moved the check into the platform, outside anything the model can be instructed to change, closing the write-to-execution route the researchers exploited.^[0]