AWS Kiro Flaw Allowed Poisoned Web Page to Execute Code
A vulnerability in AWS's Kiro IDE enabled attackers to run code on developer machines without approval.
1Discovery of the Vulnerability
Research by Intezer and Kodem Security revealed a critical flaw in AWS's Kiro IDE. Hidden text on a webpage could manipulate Kiro's configuration file, allowing attackers to execute arbitrary code remotely without developer approval, bypassing the intended security boundary.
2How the Exploit Worked
Kiro read its external tool configurations from ~/.kiro/settings/mcp.json. When this file was altered, Kiro automatically reloaded and executed the defined commands with developer privileges. Attackers could inject malicious instructions via hidden text in API documentation pages.
3Attack Scenario
Intezer's proof-of-concept used one-pixel white text on a legitimate API page. While developers saw normal documentation, Kiro interpreted the hidden block as a setup task, modifying mcp.json to launch a rogue server executing attacker code within seconds.
4AWS's Patch
AWS addressed the issue in Kiro 0.11.130 by designating sensitive files like mcp.json as protected paths, requiring explicit approval for writes. They also implemented a capability-based permission model, ensuring no unauthorized actions without developer consent.
5Historical Context
This wasn't Kiro's first configuration-file exploit. In 2025, Johann Rehberger demonstrated similar mcp.json manipulation. AWS's initial fix only added approval prompts in Supervised mode, leaving Autopilot vulnerable until Intezer's 2026 discovery forced comprehensive protections.
6Implications and Recommendations
The flaw underscores security risks in AI-assisted development tools. Developers must update to Kiro's latest version immediately. AWS's failure to assign a CVE or disclose affected versions raises transparency concerns about vulnerability management in AI coding environments.