A single line of invisible text embedded on a web page was enough to make AWS Kiro — Amazon’s agentic coding IDE — rewrite its own configuration file and silently execute attacker-controlled code on a developer’s machine, with no meaningful opportunity for the developer to intervene. Intezer, working with Kodem Security, disclosed the vulnerability on July 21, 2026, following a roughly five-month coordinated disclosure process that began in February. AWS has patched the flaw in Kiro v0.11.130, and current builds are on the v1.0.x line. No CVE has been assigned.
That last fact matters more than it might appear. Without a CVE entry in the National Vulnerability Database, the Intezer disclosure does not appear in the automated scanner results that most development teams use to flag software they need to update. Developers running any version of Kiro below v0.11.130 — released months ago — may have received no automated alert that their tool was vulnerable to remote code execution from a web page they asked it to read.
Why Kiro’s Approval Dialog Was Security Theater
Kiro’s safety model rests on a principle it calls “human in the loop”: before the agent runs shell commands, edits files, or takes actions with real consequences, it is supposed to surface a dialog that the developer must approve. That approval step is described in Kiro’s privacy and security documentation as the security boundary between an attacker and full code execution on a developer’s machine. It did not work.
The technical reason comes down to what Kiro was permitted to write before any approval was required. Kiro reads the list of external tools it is authorized to connect to — along with the exact shell command used to start each one — from a configuration file at ~/.kiro/settings/mcp.json, as documented in Kiro’s MCP configuration documentation. When that file changes, Kiro automatically reloads it and executes whatever startup commands it describes, using the developer’s operating system privileges. At the time of the research, Kiro’s fsWrite tool could write to mcp.json without triggering any approval dialog at all.
What that means in practice: anyone who could get instructions into Kiro’s context could register a malicious server in mcp.json whose startup command was arbitrary attacker code — and that code would run the moment Kiro reloaded the file, automatically, without any developer action beyond the ordinary task of asking Kiro to fetch a URL.
Intezer’s proof of concept delivered those instructions the simplest possible way: white text, at a one-pixel font size, on a white background — invisible to any human browsing the page, fully present in the HTML that Kiro read when the developer asked it to summarize a documentation page. Within seconds of that fetch completing, the rogue server entry was in mcp.json, the configuration had reloaded, and a Node.js payload was transmitting the machine’s hostname, username, and platform to a remote address. The researchers directed their callback to localhost to avoid exposing real users; in a real attack, those credentials would go to an attacker.
Kiro did, in some cases, display a pop-up warning that the MCP configuration had changed. It made no difference: the configuration reloaded regardless of what the developer clicked. The only approval the developer had actually given was “fetch this URL” — ordinary behavior that raised no suspicion.
The attack was confirmed on Kiro v0.9.2 on macOS and v0.10.16 on Ubuntu. It is non-deterministic — the model may sometimes ignore the hidden instruction, and in Intezer’s testing it succeeded within one or two attempts — but from an attacker’s perspective, one success is all that is needed.
This Was Kiro’s Third Time Facing the Same Attack Class
On Kiro’s public launch day in July 2025, Johann Rehberger of Embrace The Red documented the identical mcp.json write-to-execution move. AWS responded with Kiro v0.1.42 (AWS Security Bulletin AWS-2025-019) but only added confirmation prompts in Supervised mode; Autopilot continued writing configuration files. A third variant from Cymulate (.vscode/tasks.json auto-execute) received CVE-2026-10591 and was fixed in the v0.11 series. Intezer’s February 2026 report was still live on v0.9.2 and v0.10.16; the patch shipped in v0.11.130 without a CVE.
What Developers Should Do
Developers running any Kiro version below v0.11.130 should update immediately. Current builds are on the v1.0.x line — v1.0.165 was the latest as of July 21, 2026. Because no CVE was assigned and AWS published no list of affected versions, this update is not scanner-discoverable; it requires a manual check.
Disclosure Timeline
- February 11, 2026 — Intezer reports the vulnerability to AWS through HackerOne.
- February 12–28, 2026 — Correspondence with HackerOne triage team.
- March 6, 2026 — Ticket transferred to AWS’s Coordinated Vulnerability Disclosure team.
- April 3, 2026 — AWS confirms the fix shipped in the latest Kiro release, without specifying the version.
- July 21, 2026 — Intezer and Kodem Security publish findings; researchers confirm the patch in v0.11.130.
Primary research post: https://www.kodemsecurity.com/resources/aws-kiro-agentic-ide-rce-prompt-injection-mcp-config-vulnerability