Researchers at **Intezer**, working with **Kodem Security**, uncovered a significant vulnerability in **AWS Kiro**, **Amazon Web Services**' agentic coding IDE. The flaw allowed for remote code execution (RCE) simply by embedding hidden text within a web page that **Kiro** was instructed to summarize. ### The Bypassed Security Model **Kiro**'s core security model relies on a developer's explicit approval before executing potentially risky actions like running shell commands, fetching URLs, or editing files. This 'human in the loop' approval step is designed to be the primary security boundary. However, the discovered vulnerability allowed an attacker to completely bypass this critical step, enabling arbitrary code execution without the developer ever being prompted for consent. ### How the Attack Worked The exploit leveraged **Kiro**'s ability to read and modify its `~/.kiro/settings/mcp.json` configuration file. This file dictates which external tools, known as Model Context Protocol (MCP) servers, **Kiro** should load and the commands used to start them. At the time of the research, **Kiro** could write to `mcp.json` using its `fsWrite` tool without requiring approval, and would automatically reload the file upon modification. An attacker could influence the contents of this `mcp.json` file to register a malicious server whose start command was arbitrary code. The moment **Kiro** reloaded the modified configuration, the attacker's code would execute with the developer's privileges. ### Injecting Malicious Instructions Injecting the malicious text into **Kiro**'s context proved to be straightforward. The agent frequently pulls in external content when asked to fetch URLs, read documentation, or search the web. **Intezer**'s proof-of-concept demonstrated this by embedding instructions as one-pixel white text (`color:#fff;font-size:1px`) on an otherwise innocuous API documentation page.  From the developer's perspective, the page appeared clean. However, **Kiro** would read the hidden block as a setup task, write the malicious server definition into `mcp.json`, and then reload. Within seconds, the rogue server would launch, executing the attacker's code. While **Intezer**'s demo payload merely 'phoned home' with basic machine details, this primitive could be exploited to steal credentials, source code, establish persistence, or pivot into internal systems. Although **Kiro** occasionally displayed a pop-up warning about MCP configuration changes, this proved ineffective as the configuration reloaded regardless of the developer's choice. ### A Recurring Pattern This isn't the first time **Kiro** has faced vulnerabilities related to its ability to modify critical configuration files. On **Kiro**'s release day in July 2025, **Johann Rehberger** of **Embrace The Red** demonstrated a similar `mcp.json` write-to-execution exploit through prompt injection. He also identified a second route via `.vscode/settings.json`, which **AWS** addressed in **Kiro** 0.1.42 by adding an approval prompt, but only in 'Supervised mode', leaving the default 'Autopilot' mode vulnerable. Another instance saw **Cymulate** report that **Kiro** would auto-execute code written to `.vscode/tasks.json` when a folder was opened. This led to **AWS** assigning **CVE-2026-10591** (CVSS 3.1 score 8.8, CVSS 4.0 score 8.6) and issuing a fix in the 0.11 series. ### The Fix and Lessons Learned **Intezer** reported their `mcp.json` chain vulnerability in February 2026, confirming it was active on **Kiro** versions 0.9.2 (macOS) and 0.10.16 (Ubuntu). **AWS** subsequently patched the issue, with researchers confirming the fix in v0.11.130. **AWS**'s long-term solution involved enhancing platform-level controls. **Kiro** now treats `mcp.json`, `.vscode/tasks.json`, `.git` directories, and other sensitive files as [protected paths](https://kiro.dev/docs/privacy-and-security/#protected-paths), requiring explicit approval for any write operations. This check is enforced in both 'Autopilot' and 'Supervised' modes, effectively closing the attack vector **Intezer** exploited. The 1.0 release of **Kiro** further reinforces this with a [capability-based permissions model](https://kiro.dev/docs/whats-new-1-0/) that prompts for consent on any action a developer hasn't explicitly allowed. Despite the severity, no **CVE** has been assigned to **Intezer**'s specific `mcp.json` finding. **Intezer** reported no in-the-wild exploitation, and their research focused on the **Kiro IDE**, not the separate **Kiro CLI** or Web builds. Users on older versions of **Kiro** are strongly advised to update to the latest 1.0.x line (1.0.165 as of July 21, 2026) from **Kiro**'s [downloads page](https://kiro.dev/downloads/). The recurring nature of these vulnerabilities across **Kiro** and other AI coding tools underscores a critical lesson: robust security controls must be implemented at the platform level, independent of the model's judgment. As development workflows increasingly incorporate AI agents that interact with the open web, the 'human in the loop' only functions as a security control if the critical steps requiring approval are clearly presented, and the underlying platform steadfastly enforces security boundaries, even when the model attempts to circumvent them.