Hidden Web Text Hijacked Kiro and Ran Attacker Code: AWS Confirms No CVE Assigned

A single line of invisible text embedded on a web page was enough to make AWS Kiro — Amazon's agentic coding IDE — rewrite its own configuration file and silently execute attacker-controlled code on a developer's machine, with no meaningful opportunity for the developer to intervene. Intezer, working with Kodem Security, disclosed the vulnerability on July 21, 2026 , following a roughly five-month coordinated disclosure process that began in February. AWS has patched the flaw in Kiro v0.11.130, and current builds are on the v1.0.x line. No CVE has been assigned.

That last fact matters more than it might appear. Without a CVE entry in the National Vulnerability Database, the Intezer disclosure does not appear in the automated scanner results that most development teams use to flag software they need to update. Developers running any version of Kiro below v0.11.130 — released months ago — may have received no automated alert that their tool was vulnerable to remote code execution from a web page they asked it to read.

Kiro's safety model rests on a principle it calls "human in the loop": before the agent runs shell commands, edits files, or takes actions with real consequences, it is supposed to surface a dialog that the developer must approve. That approval step is described in Kiro's privacy and security documentation as the security boundary between an attacker and full code execution on a developer's machine. It did not work.

The technical reason comes down to what Kiro was permitted to write before any approval was required. Kiro reads the list of external tools it is authorized to connect to — along with the exact shell command used to start each one — from a configuration file at ~/.kiro/settings/mcp.json , as documented in Kiro's MCP configuration documentation . When that file changes, Kiro automatically reloads it and executes whatever startup commands it describes, using the developer's operating system privileges. At the time of the research, Kiro's fsWrite tool could write to mcp.json without triggering any approval dialog at all.

What that means in practice: anyone who could get instructions into Kiro's context could register a malicious server in mcp.json whose startup command was arbitrary attacker code — and that code would run the moment Kiro reloaded the file, automatically, without any developer action beyond the ordinary task of asking Kiro to fetch a URL.

Intezer's proof of concept delivered those instructions the simplest possible way: white text, at a one-pixel font size, on a white background — invisible to any human browsing the page, fully present in the HTML that Kiro read when the developer asked it to summarize a documentation page. Within seconds of that fetch completing, the rogue server entry was in mcp.json , the configuration had reloaded, and a Node.js payload was transmitting the machine's hostname, username, and platform to a remote address. The researchers directed their callback to localhost to avoid exposing real users; in a real attack, those credentials would go to an attacker.

Kiro did, in some cases, display a pop-up warning that the MCP configuration had changed. It made no difference: the configuration reloaded regardless of what the developer clicked. The only approval the developer had actually given was "fetch this URL" — ordinary behavior that raised no suspicion.

The attack was confirmed on Kiro v0.9.2 on macOS and v0.10.16 on Ubuntu. It is non-deterministic — the model may sometimes ignore the hidden instruction, and in Intezer's testing it succeeded within one or two attempts — but from an attacker's perspective, one success is all that is needed.

The accountability dimension of this disclosure is not the vulnerability in isolation; it is the pattern.

On Kiro's public launch day in July 2025, Johann Rehberger of Embrace The Red documented the identical mcp.json write-to-execution move. A prompt injection payload dropped custom code into the MCP settings file, and the code ran the moment the file saved. Rehberger also identified a second path: writing to .vscode/settings.json to allowlist arbitrary shell commands, again without triggering an approval dialog.

AWS responded with Kiro v0.1.42, published August 1, 2025, as detailed in AWS Security Bulletin AWS-2025-019 . That update added a confirmation prompt for those writes — but only when Kiro was running in Supervised mode. The default Autopilot mode continued writing configuration files on its own. No CVE was assigned for the Rehberger finding either.

A third variant came from Cymulate, which found that Kiro would auto-execute code written to .vscode/tasks.json whenever a project folder was opened — no fetched URL required, no prompt injection needed beyond getting malicious content into the repository. AWS assigned that one CVE-2026-10591 (rated 8.8 under CVSS 3.1 and 8.6 under CVSS 4.0) and fixed it in the v0.11 release series, with Security Bulletin 2026-037-AWS .

Intezer's mcp.json chain, reported in February 2026, was still live on v0.9.2 and v0.10.16 when it was reported. The patch shipped in v0.11.130. Unlike the Cymulate finding, AWS never specified which versions were affected and never assigned a CVE. The researchers confirmed the fix themselves.

Three separate research teams, finding the same attack shape — an agent rewriting the files that govern what it is permitted to execute — across approximately twelve months.

The deeper lesson here is architectural, and it applies to every agentic IDE, not just Kiro.

Prompt injection — the attack class this chain exploits — works by placing instructions inside data that an AI model reads, causing the model to treat those instructions as commands from the user. According to the OWASP LLM Top 10 , the reason no filter, fine-tuning approach, or guardrail has eliminated this attack class is that large language models have no reliable mechanism to distinguish data from instructions when both appear in the same context window. The model treated the hidden text as a setup task because, from the model's perspective, it was indistinguishable from a legitimate instruction.

Security researcher Simon Willison named the essential vulnerability in June 2025 as the "lethal trifecta": any agent that reads untrusted data, has access to private information, and can communicate externally is permanently exposed to some form of prompt injection attack. The OWASP GenAI Security Project's State of Agentic AI Security and Governance report , published June 11, 2026, concluded directly: "The central security weakness of these systems — prompt injection — may not be a bug that a future release will fix. It may be structural."

What does work — and what Kiro's own documentation now states explicitly — is moving controls out of the model's judgment and into the platform layer. After the Intezer disclosure, Kiro added a protected-paths system that marks mcp.json , .vscode/tasks.json , the .git directory, and other sensitive files as requiring explicit developer approval before any write, enforced at the platform level regardless of whether Kiro is running in Autopilot or Supervised mode. This is described in Kiro's protected-paths documentation . The 1.0 release extended this further with a capability-based permissions model that prompts for consent on any action not already explicitly authorized, as detailed in Kiro's 1.0 release documentation .

Kiro's current documentation puts the principle in plain language: "Supervised mode is a code review workflow, not a security control." The protection that matters is the one the platform enforces, not the one the model is asked to honor.

The Kiro disclosure sits inside a much broader research record. In December 2025, security researcher Ari Marzouk catalogued more than 30 flaws documented across AI coding tools including Cursor, Windsurf, GitHub Copilot, Zed, Roo Code, and Kiro — all exploiting the same structural tension: legitimate editor capabilities (web access, file writes, shell execution) become prompt injection vectors when the agent ingests content from untrusted sources. Of those, 24 received CVE identifiers. Kiro was on the list then; it is on the list again now.

Microsoft's Defender Security Research Team documented the same pattern in its own AI agent frameworks in May 2026. GitHub Copilot CLI addressed a related configuration-trust loophole with a July 2026 update specifically to prevent agents from editing files in plan mode.

The pattern is consistent enough to have a name: IDEsaster. The name reflects what Marzouk found: not a series of isolated bugs in individual products, but a universal attack chain that "affected each and every AI IDE tested."

Developers running any Kiro version below v0.11.130 should update immediately via Kiro's downloads page . Current builds are on the v1.0.x line — v1.0.165 was the latest as of July 21, 2026. Because no CVE was assigned to the Intezer finding and AWS published no list of affected versions, developers relying on automated vulnerability scanners may not have received any alert. This update is not scanner-discoverable; it requires a manual check.

Three practices reduce exposure for any agentic IDE, not just Kiro:

Treat every external URL an agentic IDE fetches as potentially adversarial. The attack surface for this class of flaw is any content the agent reads — documentation, results, web pages, repository files.

Review MCP configuration files after any session that involved web fetches or documentation lookups. A rogue server entry in mcp.json persists across sessions; checking the file takes seconds.

Prefer protected-paths enforcement over relying on approval dialogs. In Kiro v0.11.130 and later, protected paths are enforced in both Autopilot and Supervised modes. In earlier versions or in other agentic IDEs that lack equivalent controls, Supervised mode is not a security substitute.

A hidden instruction in a web page fetched by Kiro could cause the IDE to write a malicious entry into ~/.kiro/settings/mcp.json , the file that controls which external tools Kiro launches at startup. When Kiro reloaded that file, the attacker's code executed with full developer privileges — no further user action required. If you are running Kiro below v0.11.130 and have used Kiro to fetch external URLs or read documentation, your machine may be at risk. Update to the current v1.0.x release from Kiro's downloads page immediately.

A CVE (Common Vulnerabilities and Exposures) identifier is what automated vulnerability scanners use to match a specific flaw against the software versions you have installed. When no CVE is assigned, the flaw does not appear in the National Vulnerability Database — which means your scanner will not flag Kiro as vulnerable, even if you are running an affected version. For this disclosure, that gap is real: AWS never published the affected version range, and Intezer confirmed the patch themselves in v0.11.130 after AWS confirmed only that "the latest release" included a fix. Developers who rely on scanners for update alerts received no automatic notification. This is a manual update.

The approval dialog appeared after the MCP configuration had already been reloaded — not before. And in Intezer's testing, the configuration reloaded regardless of what the developer clicked. The dialog was informational, not blocking. More fundamentally, the only action the developer was shown for approval was "fetch this URL" — a routine, low-suspicion request. The downstream consequence of that fetch (the configuration file being rewritten and new code running) never appeared as a discrete approval step. AWS's post-patch documentation makes the design principle explicit: Supervised mode is a code review workflow, not a security control. The only controls that protect against prompt injection are ones enforced at the platform layer, outside anything the model can be instructed to modify.

The same structural vulnerability — an agent that reads untrusted content, writes configuration files, and executes shell commands — exists across the AI coding tool ecosystem. In December 2025, more than 30 flaws of the same class were documented across Cursor, GitHub Copilot, Windsurf, Roo Code, Zed, and Kiro. Cymulate's June 2026 research found related attack paths in Cursor CLI, Codex Desktop, and Gemini CLI simultaneously with the Kiro variant. The OWASP GenAI Security Project concluded in June 2026 that prompt injection in agentic systems may be structural rather than patchable — meaning no single update fully eliminates the attack surface, only specific pathways within it.