AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

# A Web Page Was All It Took to Own a Developer's Machine Through AWS Kiro

## The Threat

AWS Kiro, the company's agentic coding IDE, had a fundamental problem at its security boundary: the thing protecting developers wasn't actually protecting them. The agent's safety model depends on a human clicking "allow" before anything consequential happens — shell commands, file writes, URL fetches. That approval step was supposed to be the line attackers couldn't cross. It wasn't.

Researchers at Intezer, working with Kodem Security, demonstrated that a developer asking Kiro to do something as routine as fetching API documentation could end with an attacker's code running silently on their machine. The developer never got a meaningful choice. In some cases Kiro showed a pop-up saying its MCP configuration had changed and requesting approval — and then reloaded the configuration anyway, regardless of what was clicked. The warning was theater.

The actual mechanism is direct: Kiro reads its list of Model Context Protocol servers and their startup commands from ~/.kiro/settings/mcp.json. When that file changes, Kiro reloads it and launches whatever it describes, using the developer's own privileges. At the time of Intezer's research, Kiro's fsWrite tool could overwrite mcp.json without any approval step, and the file would be reloaded automatically. Getting attacker-controlled text into Kiro's context was the only remaining problem — and that part is almost trivially easy. Any page Kiro fetches becomes potential attack surface. Intezer's proof of concept planted instructions in one-pixel white text (color:#fff;font-size:1px) on an otherwise clean API reference page. The developer sees documentation. Kiro reads a setup task, writes a malicious server entry into mcp.json, and within seconds the rogue process starts. In their demo, it phoned home with hostname, username, and platform every ten seconds — enough to prove execution. The same primitive could steal credentials, exfiltrate source code, establish persistence, or pivot into internal systems.

## Severity and Impact

No CVE was assigned to Intezer's specific mcp.json chain. A related class of vulnerability in Kiro — auto-execution via .vscode/tasks.json — was assigned a CVE and scored separately.

| Detail | Value |

|---|---|

| CVE (Intezer mcp.json chain) | Not assigned |

| CVE (related .vscode/tasks.json flaw) | CVE-2026-10591 |

| CVSS 3.1 Score | 8.8 (High) |

| CVSS 4.0 Score | 8.6 (High) |

| Attack Vector | Network (via fetched content / prompt injection) |

| Attack Complexity | Low |

| Authentication Required | None (victim initiates fetch) |

| User Interaction | Required (developer asks Kiro to fetch a URL) |

| Impact | Remote code execution on developer host |

| Patch Status | Fixed by AWS; no patch version publicly confirmed in advisory |

## Affected Products

- Specifically: any version where fsWrite could overwrite ~/.kiro/settings/mcp.json without approval

- Autopilot mode was the affected configuration; Supervised mode had a partial mitigation (approval prompt for MCP writes) but was not the default

## Mitigations

For developers using AWS Kiro:

For security and platform teams:

General:

## References

---

## HackWire Analysis

This story is not really about a clever attack. It's about a design assumption that was wrong from the start, survived a public disclosure, and had to be broken twice before it was fixed.

The pattern here is one defenders should internalize: the human-in-the-loop is only meaningful if the loop actually stops when the human says no. Kiro's approval dialog for MCP configuration changes was shown, and then ignored. That's not a bug in a narrow sense — it reflects a category of mistake where safety UX is bolted onto an architecture that doesn't enforce it. The dialog existed because someone knew this was risky. The enforcement didn't follow.

What makes this especially worth watching is the timeline. Rehberger demonstrated the mcp.json write-to-execution path on Kiro's release day in July 2025. AWS patched it in a way that protected Supervised mode and left Autopilot — the default, the mode most developers actually use — untouched. Intezer's 2026 chain used that same gap. No CVE was issued for either instance of the mcp.json class.

The broader risk isn't AWS-specific. Every agentic coding tool that fetches external content and has write access to its own configuration is a candidate for the same class of attack. Cursor, Copilot agents, and similar tools all live in this territory. The attack surface is any page your agent can read. For a tool whose purpose is to browse documentation and fetch references, that surface is enormous.

Security teams should be asking a harder question than "is Kiro patched?" They should be asking which other agents on developer machines can rewrite the files that govern what they run.

— HackWire Editorial

## Related Coverage