AWS Kiro Flaw Lets Poisoned Web Pages Run Code on Developer Machines

Security researchers at Intezer, working with Kodem Security, have disclosed a serious vulnerability in AWS's agentic coding IDE, Kiro, that allowed a malicious web page to silently rewrite the tool's own configuration and execute attacker-controlled code on a developer's machine. The flaw, which AWS has since patched without assigning a CVE, bypassed the human approval step that is supposed to serve as Kiro's primary security boundary, meaning developers were never given the chance to block the malicious action. In their proof of concept, the researchers showed that simply asking Kiro to summarize an ordinary-looking API documentation page was enough to trigger remote code execution with the developer's own privileges.

The root cause lay in Kiro's Model Context Protocol (MCP) configuration file at ~/.kiro/settings/mcp.json, which stores the list of external tools Kiro can launch and the exact commands used to start them. At the time of the research, Kiro could rewrite this file using its built-in fsWrite tool without any user approval prompt, and would then automatically reload the configuration and execute whatever commands it described. By injecting instructions through hidden text rendered in one-pixel white font (color:#fff;font-size:1px) on a benign-looking page, the researchers tricked the agent into registering a rogue MCP server whose launch command was arbitrary shellcode. The configuration reloaded regardless of whether the developer approved a warning dialog, making the single approved action, fetching a URL, the only thing standing between the attacker and full code execution.

The implications extend beyond a single IDE. Any agentic coding tool that can write to its own trust configuration without explicit approval creates a prompt injection sink capable of turning routine tasks like reading documentation or summarizing web content into a foothold for credential theft, source code exfiltration, persistence, or lateral movement into internal networks. Intezer's demonstration payload was deliberately limited, beaconing the machine's hostname, username, and platform back to localhost every ten seconds, and the researchers noted the attack is not perfectly reliable due to the non-deterministic nature of language models, succeeding within one or two attempts in their testing. Developers and security teams can use a SSL/TLS checker to verify the integrity of any documentation sources their AI tools are pulling from, run a port scanner to detect unexpected listeners that rogue MCP servers may spin up, and perform a broader privacy checkup to harden the environment in which agentic IDEs operate.