"Supervised mode is a code review workflow, not a security control." — Kiro's documentation.
What researchers discovered: Intezer and Kodem Security's proof-of-concept
Researchers at Intezer, working with Kodem Security, demonstrated that a simple request — ask Kiro to summarize a web page — could end in remote code execution on a developer's machine. The proof-of-concept showed that Kiro, AWS's agentic coding IDE, could be induced to rewrite its own configuration file and launch arbitrary code without a meaningful approval step. Intezer reported the issue through HackerOne on February 11, 2026; by April 3 AWS said a fix had shipped, and Intezer confirmed the chain was blocked in version 0.11.130.
The technical chain: hidden text, mcp.json, and auto-reload
The weak point was the file that tells Kiro which external tools to load: ~/.kiro/settings/mcp.json. At the time of the research, Kiro would read its list of Model Context Protocol (MCP) servers and the exact command used to start each one from that file. When mcp.json changed, Kiro reloaded it and launched whatever it described, on the host, with the developer's privileges.
Crucially, Kiro could write to mcp.json on its own with its fsWrite tool, without asking for approval. Intezer's demo planted instructions in one-pixel white text (color:#fff;font-size:1px) on an API documentation page so the developer saw a normal reference while Kiro read the hidden block. Kiro wrote a malicious server entry into mcp.json, reloaded, and the rogue server started — running the attacker's code within seconds.
Scope, reliability, and impact demonstrated
Intezer ran a constrained payload that phoned home the machine's hostname, username, and platform every ten seconds to prove execution. The researchers kept callbacks pointed at localhost so no real users were exposed. They noted the model is non-deterministic and the exploit is not perfectly reliable — in testing it usually succeeded within one or two tries — but observed that one success is sufficient for compromise. Intezer reported no in-the-wild exploitation and limited its testing to the Kiro IDE; it did not establish whether Kiro CLI or Web builds shared the flaw.
History of related chains and AWS's prior fixes
This class of bug had appeared before. On Kiro's release day in July 2025, Johann Rehberger of Embrace The Red showed a prompt-injection that dropped custom code into an MCP settings file and ran it when saved. He also demonstrated writing to .vscode/settings.json to allowlist shell commands. AWS's response then — Kiro 0.1.42 — added an approval prompt for those writes but only in Supervised mode; the default Autopilot mode continued to perform the writes automatically. Other reports surfaced: Cymulate found Kiro would auto-execute code written to .vscode/tasks.json when a folder was opened; that finding was assigned CVE-2026-10591 (8.8 under CVSS 3.1, 8.6 under CVSS 4.0) and fixed in the 0.11 series.
AWS's platform fixes: protected paths and capability-based prompts
AWS moved the security boundary out of the model and into the platform. Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as protected paths; each requires explicit approval before a write. The 1.0 release introduced a capability-based permissions model that prompts for consent on anything a developer has not already allowed. Unlike the 2025 fix that only applied in Supervised mode, the protected-paths check now holds in both Autopilot and Supervised mode; Intezer confirmed the attack failed in 0.11.130. Current builds are on the 1.0.x line, with 1.0.165 listed as the latest as of July 21, 2026, and anyone on an older version is advised to update from Kiro's downloads page.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Review whether local agent tooling can write and auto-execute configuration files. The concrete controls that worked here were platform-enforced protected paths and capability-based consent, not solely a human review in the model's workflow.
- Procurement and engineering leaders: Confirm which Kiro builds you run. Intezer reported the chain was live in versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) at the time of reporting, and AWS did not publish a complete list of affected builds.
- End users and developers: Be aware that a visible approval popup can be a false boundary — Intezer found cases where Kiro displayed a pop-up about MCP configuration changes but reloaded the configuration regardless of what the developer clicked. Update to fixed builds and treat agent-generated file writes to protected paths as a red flag.
Over roughly a year, three separate research efforts found the same shape of bug: agents that could quietly edit the files that determine what they are allowed to execute. The practical lesson from Kiro's fixes is plain and precise — the control that matters sits in the platform, enforced across modes and outside whatever the model can be told to change.
Source: The Hacker News — AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
