The hidden text on the web page is enough to make Kiro, AWS’s IDE for agent code, rewrite its configuration file and run the attacker’s code on the developer’s machine, without an authorization step being able to stop it.
Intezer, in research with Kodem Security, found that a simple request like asking Kiro to summarize a page could end up being a remote code execution. AWS has released the issue, and no CVE has been assigned to it.
Kiro’s security model relies on a person clicking “allow.” The agent can run shell commands, fetch URLs, and edit files, and the design assumes that the developer checks for anything malicious before it happens. That authorization step is the security boundary, and the flaw allows an attacker to bypass it without the developer being given a choice.
The weak point was the file that tells Kiro which external tools to load. Kiro reads its list of Model Context Protocol servers, and the exact command used to start each one, from ~/.kiro/settings/mcp.json.
If that file changes, Kiro reloads it and presents whatever it describes, on the host, with developer privileges. During testing, Kiro was able to write mcp.json by itself with its fsWrite tool, no permissions required, and reload automatically.
Anyone who could influence the contents of that file could register a server whose first command was invalid code, and it would run when Kiro reloaded.
Adding text to the Kiro context is the easy part. The agent pulls external content whenever a developer asks it to fetch a URL, read documents, or search the web. Intezer’s proof-of-concept has embedded its instructions in single-pixel white text (color:#fff;font-size:1px) on the nonstandard API documentation page.
The developer sees a clean API reference. Kiro reads the hidden block as a setup function, writes the malicious server to mcp.json, and reloads. Within seconds, the rogue server starts up, and the attacker’s code runs.
In the Intezer demo, the payload only called home the machine’s hostname, username, and platform every ten seconds, which is enough to prove it works. The same primitive can use any command available to the developer, enough to steal information and source code, plant persistence, or pivot to any internal systems it can access.
The researchers ended up redirecting their attack to localhost so that no real users of Kiro were exposed, and they realized that the attack is not completely reliable: the model is not limited and can summarize the page and ignore the hidden block. In their testing, it worked within one or two trials. One success is all it takes.
Kiro, in some cases, displayed a popup saying that the MCP configuration had changed and asking for authorization. It made no difference. The configuration was reloaded regardless of what the developer clicked, so the warning provided no real protection. The only action the developer ever authorized was to fetch a URL.
Kiro has been here before
An agent that can write a file that governs what is allowed to run has appeared in Kiro before. On Kiro’s July 2025 release date, Johann Rehberger of Embace The Red demonstrated a similar mcp.json write-to-execute move: a quick injection dropped custom code into the MCP settings file and ran it when the file was saved.
He also flagged a second route, writing to .vscode/settings.json to issue whitelist shell commands. AWS’s response, Kiro 0.1.42, added authentication information for those writing, but only in supervised mode. The default Autopilot mode keeps writing the file by itself, and that’s the mode. Intezer’s chain of 2026 is used. No CVE was issued at that time.
Others find neighboring versions of the same class. Cymulate reported that Kiro will automatically run the code written to .vscode/tasks.json when the folder is opened. AWS issued CVE-2026-10591 (8.8 under CVSS 3.1, 8.6 under CVSS 4.0) and fixed it in the 0.11 release.
Intezer’s mcp.json chain was live in versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) when the company reported in February 2026, and was confirmed to be patched in v0.11.130.
AWS’s response was to stop trusting the model’s judgment in these files and move the check to the server. Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as secure paths, each requiring explicit authorization before being written.
Its documentation makes this point specifically: “Supervised mode is a code review workflow, not a security control.” The 1.0 release that followed leaned heavily on the same principle, with a capabilities-based permissions model that requests permission for anything the developer hasn’t already approved.
That combination covers the route Intezer took: Intezer confirmed that the attack failed in 0.11.130, and, unlike the 2025 fix, the secure paths check handles both Autopilot and Supervised mode.
Intezer reported the bug to HackerOne on February 11, 2026, and on April 3 AWS said a fix had been shipped in its latest release, although it did not name it; the researchers confirmed it themselves in v0.11.130.
No CVE assigned: Hacker News found none in the National Vulnerability Database as of July 21, 2026, and AWS has not published a complete list of affected architectures. Intezer reported no wild exploits, and its tests included Kiro IDE; did not confirm that different Kiro CLI or Web builds shared the error.
The current build is on the 1.0.x line, with 1.0.165 listed as the latest as of July 21, 2026, and anyone on an older version should update from the Kiro download page.
Hacker News has reached out to AWS to confirm which versions of Kiro are affected and why no CVE has been assigned, and will update this story with any response.
For about a year, three separate research efforts have found the same bug in Kiro: an agent that silently edits files that determine what users are allowed to use. Kiro is not alone: in December 2025, researchers documented more than 30 flaws in all AI coding tools, Cursor and Copilot among them, all of which turned legitimate editor features into quick injection methods for code manipulation or data theft.
The current fixes all point to the same lesson: the active controller sits on the platform, forced into every mode and independent of anything the model can be told to change.
As much of the development workflow moves to agents learning the open web, the human in the loop only acts as a control when the human is shown a critical step, and the platform holds the queue even after the model has been completely told to skip it.
