AWS Kiro: Prompt Injection Rewrote Config Files for Silent RCE

AWS Kiro, Amazon’s agentic IDE, contained a prompt injection chain that could silently rewrite its own MCP server configuration and run attacker-supplied code on a developer’s machine. No approval prompt appeared. The developer saw nothing unusual. The vulnerability, tracked as CVE-2026-10591 and rated CVSS 8.8, was patched in Kiro version 0.11.130 following disclosure by Intezer and Kodem Security.

How It Worked

Kiro maintains a list of Model Context Protocol servers in a configuration file at ~/.kiro/settings/mcp.json. Each entry specifies the server name and the exact command Kiro uses to start it. That file is the trust boundary: whatever Kiro finds there, it launches.

The attack exploited that boundary through a prompt injection delivered via a web page. An attacker embeds instructions using trivial CSS concealment, white text at 1px font size, directing Kiro’s language model to add a new entry to mcp.json registering a malicious Node.js server. When a developer asks Kiro to read or summarise a page carrying that payload, the model follows the injected instructions, rewrites the config, and Kiro launches the attacker-controlled server. No approval dialogue appears. The developer’s session is now compromised at their own privilege level.

Intezer’s research, coordinated with Kodem Security, identified multiple variants of the same vulnerability class. The initial mcp.json chain was still present in versions 0.9.2 and 0.10.16 when reported. A separate finding by Cymulate showed Kiro would also auto-execute code written to .vscode/tasks.json when a folder was opened, assigned the same CVE. Both paths were closed in 0.11.130.

Why Agentic IDEs Are a Different Risk Category

The Kiro vulnerability is not surprising if you accept the premise that an IDE which takes actions on your behalf introduces a new attack surface. Standard code editors read files and display text. Kiro, like Cursor and other agentic IDEs, reads files and acts: it browses documentation, fetches dependencies, runs commands, and writes code. The attack surface extends wherever the IDE reaches.

Kiro’s security model depended on the user-approval dialogue: the IDE surfaces proposed actions and the developer clicks allow. That model works when the proposals come from the developer’s own instructions. It fails when injected instructions make the model take actions before the approval boundary is reached, or when the injected actions specifically target the config that governs which tools get launched without prompting.

This is a structural issue, not a Kiro-specific one. Any agentic IDE that reads external content and can write to execution-sensitive file paths carries a variant of this risk. The hidden text vector is low-tech: a text file, a git repository README, a documentation page, a shared Google Doc. Anywhere the IDE is asked to read, an attacker who controls the content can attempt injection.

What Changed in the Patch

AWS’s fix added explicit protection for execution-sensitive paths. Modifications to files like .vscode/tasks.json and entries in mcp.json now require user confirmation before being written. This restores the approval boundary that the vulnerability bypassed, though it depends on developers actually reviewing approval prompts rather than clicking through them.

The fix is version 0.11.130. Teams running earlier versions should update immediately. The vulnerability was disclosed responsibly: Intezer and Kodem coordinated with AWS before publication, and the patch was available before full technical details became public.

Broader Implications for Developer Security

The Kiro chain illustrates something that will repeat: prompt injection as a path to supply chain compromise on developer machines. A developer who asks their AI IDE to help them understand a third-party library, open-source repo, or competitor’s documentation is potentially feeding attacker-controlled content to a tool that can modify their local config and execute code.

Security teams should be treating agentic IDE deployments as a new class of endpoint risk:

• Audit which files your AI coding tools can write to. Execution-sensitive paths (tasks files, MCP configs, shell profiles) should be treated as privileged resources.
• Update Kiro to 0.11.130 or later immediately. Earlier versions are vulnerable to the disclosed chain.
• Review MCP server lists in developer environments. Any unfamiliar entries in ~/.kiro/settings/mcp.json or equivalent config files warrant investigation.
• Treat agentic IDEs as trust boundary points in your threat model. Code written or modified by an agent that has processed external content deserves additional review before execution in production contexts.

The approval-prompt security model is the right design intent for agentic tools. CVE-2026-10591 shows it needs to be enforced at the file system level, not just in the UI layer.

References

• The Hacker News — AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
• Intezer Research — When the AI Edits Its Own Trust Boundary: RCE in AWS’s Agentic IDE
• AWS Security Bulletin — CVE-2026-10591 Kiro IDE Insufficient File Write Restrictions
• Kodem Security — AWS Kiro RCE: Prompt Injection to Code Execution
• TechTimes — Hidden Web Text Hijacked Kiro and Ran Attacker Code