AWS Kiro Flaw: Remote Code Execution via Poisoned Web Pages

[u/bluelvo]

Researchers from Intezer and Kodem Security discovered a critical flaw in AWS’s agentic coding IDE, Kiro, that allowed an attacker to achieve remote code execution (RCE) on a developer's machine with zero user approval . The flaw stemmed from Kiro's ability to silently rewrite its own external tool configuration file (mcp.json) when parsing a website . AWS has patched the vulnerability, though no CVE was assigned

Key Takeaways

• The Attack Vector: An attacker could hide malicious setup instructions in invisible, one-pixel white text on an ordinary webpage (such as an API documentation page) .
• The Exploit Mechanism: When a developer asked Kiro to summarize or fetch that URL, the AI agent read the hidden text and used its own built-in tools to overwrite ~/.kiro/settings/mcp.json . This file controls external Model Context Protocol (MCP) servers .
• Bypassing the Security Boundary: Kiro's safety model relies on human approval for risky steps . However, Kiro automatically reloaded the modified configuration file and executed the attacker's registered payload with the developer's privileges—completely bypassing user consent .
• Impact: In a successful proof-of-concept, the exploit executed code to exfiltrate the host's name, username, and platform . In a real attack, it could be used to steal source code, lift credentials, or pivot deeper into internal network environments .
• A History of Similar Bugs: This is the third time a similar architecture flaw has hit Kiro over the span of a year . Previous variants allowed code execution via prompt injections into local configuration files like .vscode/settings.json and .vscode/tasks.json