A critical security flaw in AWS’s Kiro Integrated Development Environment (IDE) enabled malicious web pages to execute arbitrary code on developers’ machines without their consent. This vulnerability, discovered by security researchers at Intezer and Kodem Security, has since been patched by AWS.
Kiro, an agentic coding IDE developed by AWS, is designed to assist developers by automating various tasks, including running shell commands, fetching URLs, and editing files. Its security model relies on explicit user approval for executing potentially risky operations. However, the identified flaw allowed attackers to bypass this approval mechanism entirely.
The root of the issue lay in Kiro’s handling of its configuration file, specifically the ‘mcp.json’ file located in the user’s home directory. This file dictates which external tools Kiro loads and the commands used to start each one. When ‘mcp.json’ is modified, Kiro automatically reloads it and executes the specified commands with the developer’s privileges.
Exploiting this behavior, an attacker could craft a web page containing hidden instructions that, when processed by Kiro, would prompt the IDE to write malicious entries into ‘mcp.json’. For instance, a developer might request Kiro to summarize a seemingly benign web page. Unbeknownst to the developer, the page could contain concealed text that instructs Kiro to alter its configuration file. Once the file is modified, Kiro would reload it and execute the attacker’s code without any user approval.
In a proof-of-concept demonstration, researchers embedded malicious instructions in a web page’s hidden text. When a developer used Kiro to process this page, the IDE wrote the attacker’s commands into ‘mcp.json’ and executed them upon reloading the configuration. This exploit could allow attackers to steal credentials, access source code, establish persistence on the developer’s machine, or pivot into internal systems accessible to the developer.
Notably, this isn’t the first time Kiro has faced such vulnerabilities. Upon its release in July 2025, security researcher Johann Rehberger identified a similar issue where prompt injections could modify ‘mcp.json’ to execute arbitrary code. AWS addressed that vulnerability by introducing an approval prompt for file writes in Kiro version 0.1.42. However, this prompt was only active in Supervised mode, leaving the default Autopilot mode susceptible. The recent exploit leveraged this same Autopilot mode, indicating that the previous mitigation was insufficient.
In response to the latest discovery, AWS has released a patch to address the vulnerability. Developers using Kiro are strongly advised to update to the latest version to ensure their systems are protected against such exploits.
This incident underscores the critical importance of robust security measures in development tools, especially those with agentic capabilities. As AI-driven tools like Kiro become more integrated into the software development lifecycle, ensuring their security is paramount. Developers should remain vigilant, regularly update their tools, and be cautious when processing external content to mitigate potential risks.
