# AWS Kiro Flaw Allowed Poisoned Web Page to Execute Code

A vulnerability in AWS's Kiro IDE enabled attackers to run code on developer machines without approval.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-07-21
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html>
- **On Brifing:** https://brifing.si/s/38c33b68-d356-44f4-aefc-39ee264ae5ec

## Discovery of the Vulnerability

Research by Intezer and Kodem Security revealed a critical flaw in AWS's Kiro IDE. Hidden text on a webpage could manipulate Kiro's configuration file, allowing attackers to execute arbitrary code remotely without developer approval, bypassing the intended security boundary.

## How the Exploit Worked

Kiro read its external tool configurations from ~/.kiro/settings/mcp.json. When this file was altered, Kiro automatically reloaded and executed the defined commands with developer privileges. Attackers could inject malicious instructions via hidden text in API documentation pages.

## Attack Scenario

Intezer's proof-of-concept used one-pixel white text on a legitimate API page. While developers saw normal documentation, Kiro interpreted the hidden block as a setup task, modifying mcp.json to launch a rogue server executing attacker code within seconds.

## AWS's Patch

AWS addressed the issue in Kiro 0.11.130 by designating sensitive files like mcp.json as protected paths, requiring explicit approval for writes. They also implemented a capability-based permission model, ensuring no unauthorized actions without developer consent.

## Historical Context

This wasn't Kiro's first configuration-file exploit. In 2025, Johann Rehberger demonstrated similar mcp.json manipulation. AWS's initial fix only added approval prompts in Supervised mode, leaving Autopilot vulnerable until Intezer's 2026 discovery forced comprehensive protections.

## Implications and Recommendations

The flaw underscores security risks in AI-assisted development tools. Developers must update to Kiro's latest version immediately. AWS's failure to assign a CVE or disclose affected versions raises transparency concerns about vulnerability management in AI coding environments.

## Sources covering this story

- https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._