AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
A flaw in AWS's Kiro agentic coding IDE allowed a poisoned web page to rewrite its config and run attacker's code on a developer's machine without approval. The issue has been patched, and no CVE has been assigned.
Intelligence analysis by Llama
A poisoned web page could rewrite Kiro's config and run attacker's code on a developer's machine without approval, highlighting a security flaw in the IDE. The issue has been patched, and no CVE has been assigned.
Imagine you're using a coding tool that can do things for you, like fetch URLs or edit files. But what if someone could trick the tool into doing something bad without you knowing? That's what happened with a tool called Kiro, which is used by developers to make coding easier. A flaw in Kiro's design let someone put bad code on a developer's machine without them knowing, and it could have been used to steal secrets or do other bad things. Luckily, the people who made Kiro fixed the problem, and now the tool is safer to use.
Analysis
A Critical Flaw in Kiro's Design
The recent discovery of a flaw in AWS's Kiro agentic coding IDE has raised concerns about the security of coding tools. The issue, which has been patched, allowed a poisoned web page to rewrite Kiro's config and run attacker's code on a developer's machine without approval. This highlights a critical flaw in Kiro's design, which relies on a human clicking 'allow' to secure the agent's actions. However, the flaw let an attacker slip past this security boundary without the developer ever being offered a choice.
The Weak Point: mcp.json
The weak point in Kiro's design was the file that tells Kiro which external tools to load. Kiro reads its list of Model Context Protocol servers and the exact command used to start each one from ~/.kiro/settings/mcp.json. When this file changes, Kiro reloads it and launches whatever it describes, on the host, with the developer's privileges. At the time of the research, Kiro could write to mcp.json on its own with its fsWrite tool, no approval required, and reload it automatically.
The Attack
Intezer's proof of concept planted its instructions in one-pixel white text on an otherwise ordinary API documentation page. The developer sees a clean API reference, but Kiro reads the hidden block as a setup task, writes the malicious server into mcp.json, and reloads. Within seconds, the rogue server starts, and the attacker's code is running. In Intezer's demo, the payload only phoned home with the machine's hostname, username, and platform every ten seconds, just enough to prove execution.
A History of Similar Flaws
This is not the first time a similar flaw has been found in Kiro. In July 2025, Johann Rehberger of Embrace The Red showed the same mcp.json write-to-execution move: a prompt injection dropped custom code into an MCP settings file and ran it the moment the file saved. AWS's response was to add an approval prompt for those writes in Supervised mode, but the default Autopilot mode kept writing the file on its own, and that is the mode Intezer's 2026 chain used. No CVE was issued then either. Others found neighboring versions of the same class.
The Fix
AWS's answer was to stop trusting the model's judgment on these files and move the check into the platform. Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as protected paths, each requiring explicit approval before a write. Its own documentation makes the point directly: 'Supervised mode is a code review workflow, not a security control.' The 1.0 release that followed leans harder on the same principle, with a capability-based permissions model that prompts for consent on anything a developer has not already allowed.
Key points
- A flaw in AWS's Kiro agentic coding IDE allowed a poisoned web page to rewrite its config and run attacker's code on a developer's machine without approval.
- The issue has been patched, and no CVE has been assigned.
- The flaw highlighted a critical weakness in Kiro's design, which relies on a human clicking 'allow' to secure the agent's actions.
- The weak point in Kiro's design was the file that tells Kiro which external tools to load.
- Intezer's proof of concept planted its instructions in one-pixel white text on an otherwise ordinary API documentation page.
The fix for the Kiro flaw is a step in the right direction for coding tool security. With the introduction of a capability-based permissions model, developers will be prompted for consent on sensitive actions, reducing the risk of similar attacks in the future.
The discovery of the Kiro flaw highlights the ongoing struggle to secure coding tools. As more developers rely on these tools, the potential for similar attacks will continue to exist unless the industry prioritizes security and transparency in tool design.
