Researchers from Intezer together with Kodem Security discovered in the agentic IDE AWS Kiro an attack chain that allowed an attacker, via hidden text on an ordinary web page, to achieve remote execution of arbitrary code on a developer’s machine. The attack exploited the agent’s ability to overwrite the configuration file of Model Context Protocol servers without actual user approval. AWS has fixed the issue, but a separate CVE was not assigned for this vulnerability. All Kiro users on versions below 0.11.130 must immediately update to the current 1.0.x build via the official download page.
Attack mechanism: from web page to code execution
Kiro’s security architecture was based on a “human-in-the-loop” model: the agent could run shell commands, fetch URLs and edit files, but it was assumed that the developer would approve every risky action. The vulnerability made it possible to fully bypass this safeguard mechanism.
According to the researchers, the key link in the chain was the ~/.kiro/settings/mcp.json file, which defines the list of Model Context Protocol servers and the commands used to launch them. When this file is modified, Kiro automatically reloads the configuration and starts the servers described in it with the current user’s privileges. At the time of the research, the agent could write to mcp.json using the built-in fsWrite tool without requesting approval.
A classic technique was used to deliver malicious instructions into the agent’s context: in the demonstration scenario, the instructions were placed as one-pixel white text (color:#fff;font-size:1px) on a page that outwardly looked like ordinary API documentation. The developer saw a clean reference page, while the agent interpreted the hidden block as a configuration task, wrote the malicious server into mcp.json, and reloaded the configuration. Within seconds, a rogue MCP server controlled by the attacker was launched and began executing their code.
As the researchers report, in the demo the payload sent a callback every ten seconds with the hostname, username, and platform — enough to confirm execution. The same primitive could be used to run any command available to the developer: steal credentials and source code, establish persistence in the system, or pivot to attack internal infrastructure.
Notably, in some cases Kiro displayed a pop-up notification about an MCP configuration change, requesting approval. However, according to Intezer, the configuration was reloaded regardless of the user’s response — the warning did not provide real protection. The only action the developer was actually approving was the URL fetch.
The researchers note that the attack is not perfectly reliable: the model is nondeterministic and may ignore the hidden block, simply summarizing the page contents. Nevertheless, in tests the attack succeeded within one or two attempts. The callback was directed to localhost, so real users were not affected.
Timeline: three researches — one architectural problem
The vulnerability discovered by Intezer is not the first case of exploiting this architectural pattern in Kiro. On the product’s release day in July 2025, Johann Rehberger from Embrace The Red demonstrated a similar vector: a prompt injection wrote code into the MCP settings file and executed it upon save. He also pointed out a second route — writing to .vscode/settings.json to add shell commands to the allowlist.
AWS responded by releasing Kiro 0.1.42, adding an approval prompt for such writes, but according to security bulletin AWS-2025-019, this protection applied only in Supervised mode. The Autopilot mode, used by default, continued to allow writes without approval — this is exactly what Intezer’s 2026 attack chain exploited.
At the same time, Cymulate discovered a related vulnerability: Kiro automatically executed code written into .vscode/tasks.json when a folder was opened. AWS assigned this issue the identifier CVE-2026-10591 with a score of 8.8 under CVSS 3.1 and 8.6 under CVSS 4.0, and addressed it in the 0.11 series, as confirmed in an AWS security bulletin.
According to Intezer, the chain via mcp.json remained functional on versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) at the time the report was submitted via HackerOne on 11 February 2026. The researchers confirmed the fix in version 0.11.130.
Mitigations and the current protection model
AWS has shifted from trusting model decisions regarding sensitive files to enforcing checks at the platform level. According to the Kiro security documentation, the mcp.json and .vscode/tasks.json files, the .git directory, and other critical paths are now classified as protected and require explicit approval before writing.
The documentation states explicitly: “Supervised mode is a code review workflow, not a security control” — Supervised mode is a code review workflow, not a security mechanism. The Kiro 1.0 release implements a capability-based permissions model, prompting the user for consent for any action that has not been pre-approved. Protection of protected paths applies in both modes — Autopilot and Supervised.
Intezer has confirmed that the attack is not reproducible starting from version 0.11.130. No exploitation of the vulnerability in real-world attacks has been recorded so far, but a public PoC is available. The research focused only on the Kiro IDE — whether the issue extends to Kiro CLI or the web version has not been established.
Recommendations
- Immediately update Kiro to the current 1.0.x version. At the time of publication, the latest available build is 1.0.165.
- Check the contents of
~/.kiro/settings/mcp.jsonfor unknown MCP servers or suspicious launch commands. - Do not use versions below 0.11.130 — they are vulnerable to the described attack chain.
- Limit automatic loading of external content in agentic IDEs: every URL that the agent fetches at the developer’s request is a potential prompt injection vector.
- Audit configuration files (
mcp.json,.vscode/tasks.json,.vscode/settings.json) in CI/CD pipelines and during reviews — any unexpected changes in them may indicate compromise.
Three independent pieces of research over a year revealed the same architectural flaw: an agent capable of editing the very files that define the boundaries of its own privileges. This is not a problem unique to Kiro — similar classes of vulnerabilities have been found in other agentic development environments. The key lesson: a “security mechanism” that the model can bypass by manipulating its context is not a security mechanism. Controls must be implemented at the platform level, beyond the agent’s reach, and must apply in all modes of operation without exception.
