Full Report
Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been
Analysis Summary
# Vulnerability: Unauthorized RCE via MCP Configuration Manipulation in AWS Kiro
## CVE Details
- **CVE ID**: None Assigned (Note: A related flaw in `.vscode/tasks.json` was designated CVE-2026-10591, but this specific `mcp.json` chain was patched without a CVE).
- **CVSS Score**: Estimated 8.6 - 8.8 (High/Critical)
- **CWE**: CWE-94 (Improper Control of Generation of Code), CWE-436 (Interpretation Conflict)
## Affected Systems
- **Products**: AWS Kiro (Agentic Coding IDE)
- **Versions**:
- macOS versions up to 0.9.2
- Ubuntu versions up to 0.10.16
- All versions prior to 0.11.130
- **Configurations**: Default "Autopilot" mode; specifically systems where the AI agent has write access to internal configuration directories.
## Vulnerability Description
The vulnerability is a logic flaw in how Kiro manages its Model Context Protocol (MCP) servers. Kiro defines external tools and their execution commands in a local configuration file located at `~/.kiro/settings/mcp.json`.
The security model intended to rely on human approval for risky actions. However, the `fsWrite` tool allowed the AI agent to overwrite its own `mcp.json` file without triggering an approval prompt. Because Kiro automatically reloads this file upon modification and executes the "start" commands defined within, an attacker can use indirect prompt injection (e.g., via hidden text on a website) to trick the agent into writing a malicious command into the configuration file. This results in the execution of arbitrary code with the user's privileges.
## Exploitation
- **Status**: PoC available (Developed by Intezer/Kodem Security).
- **Complexity**: Low (Requires the user to task the IDE with a common action like summarizing a URL).
- **Attack Vector**: Network (Indirect Prompt Injection via poisoned web content).
## Impact
- **Confidentiality**: High (Full access to developer's files, source code, and environment variables).
- **Integrity**: High (Ability to modify local configuration and source code).
- **Availability**: High (Potential for persistent malware or system disruption).
## Remediation
### Patches
- **Update to AWS Kiro v0.11.130 or later**: AWS has implemented "protected paths" that prevent the AI agent from modifying sensitive files like `mcp.json`, `.vscode/tasks.json`, and the `.git` directory without explicit, out-of-band platform-level validation.
### Workarounds
- **Disable Autopilot Mode**: Use "Supervised" mode to ensure all file writes require a manual review, though researchers noted early versions of this check could be bypassed or ignored by the reload logic.
- **Network Isolation**: Restrict the IDE's ability to fetch and parse external URLs from untrusted sources.
## Detection
- **Indicators of Compromise**:
- Unexpected modifications to `~/.kiro/settings/mcp.json`.
- Unauthorized processes spawning from the Kiro IDE parent process.
- Outbound network connections to unknown IP addresses from developer workstations.
- **Detection Methods**: Monitor file integrity for `.kiro` and `.vscode` configuration directories using EDR (Endpoint Detection and Response) tools.
## References
- [https://thehackernews[.]com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html]
- [https://research.intezer[.]com/blog/2026/07/remote-code-execution-kiro/]
- [https://aws.amazon[.]com/security/security-bulletins/2026-037-aws/]
- [https://embracethered[.]com/blog/posts/2025/aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection/]