A recently identified vulnerability in AWS’s Kiro Integrated Development Environment (IDE) has exposed a critical security flaw that enables remote code execution (RCE) through hidden instructions embedded within web content. This issue underscores significant concerns regarding the security of AI-powered development tools.
Kiro is an AI-driven IDE designed to assist developers by automating various coding tasks. It operates on a “human-in-the-loop” model, requiring user approval for actions such as executing shell commands or modifying sensitive files. This mechanism is intended to ensure that developers maintain control over the AI’s operations.
However, researchers have discovered that this security model can be circumvented through prompt injection attacks. Unlike traditional systems that separate data from executable instructions, large language models (LLMs) like those used in Kiro process all input as potential commands. This characteristic makes them susceptible to prompt injection, where hidden instructions within input data can manipulate the model’s behavior.
Exploitation Through Hidden Web Content
The vulnerability centers around Kiro’s handling of its Model Context Protocol (MCP) configuration file, located at `~/.kiro/settings/mcp.json`. This file defines external tools and their associated commands. Kiro automatically reloads and executes commands from this file whenever it is modified.
Researchers found that the MCP configuration file lacks adequate protection and can be altered by the AI agent using internal tools without user approval. An attacker can exploit this by embedding hidden instructions into seemingly benign web content. For instance, if a developer requests Kiro to summarize documentation or fetch a webpage containing concealed prompt injection payloads, Kiro processes both visible and hidden text. The injected instructions can direct Kiro to overwrite the MCP configuration file with malicious content, registering a server that executes arbitrary code on the host system. Once modified, Kiro automatically reloads and runs the payload without the developer’s knowledge.
A proof-of-concept demonstrated how attackers could deploy a lightweight Node.js payload to exfiltrate system information, such as hostname, username, and platform details, to a remote server. While this demonstration was limited to benign data collection, the same method could be used to steal credentials, access source code, or perform other malicious activities. Notably, the user remains unaware of the breach, believing they have only approved a routine web request. No warnings are displayed about file modifications or code execution, and security prompts regarding configuration changes fail to prevent the malicious activity.
Implications and Mitigation
This vulnerability highlights the fragility of relying solely on user approval as a security boundary in AI-powered tools. If an AI agent can modify its execution environment without adequate safeguards, the underlying trust model is compromised. This risk is particularly concerning when the IDE has access to sensitive credentials or production infrastructure.
AWS has addressed this issue in later versions of Kiro, with fixes confirmed in version 0.11.130. However, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned to this vulnerability. Developers using Kiro are strongly advised to update to the latest version to mitigate this risk.
This incident underscores the urgent need for robust security measures in AI-driven development environments. As these tools become more integrated into the software development lifecycle, ensuring their security is paramount to protect against potential exploitation.
