Return to Threats

Clean GitHub Repo Tricks AI Coding Agents into Running Malware

Agentic Threat Tracker / Whiteintel 2026-07-21 AI agent abuse Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

CVE-2026-10591 in AWS Kiro let hidden prompt injection in web pages or source files rewrite Kiro's MCP server configuration or allowlist arbitrary Bash commands, giving code execution without approval; trojanized LiteLLM releases on PyPI also exfiltrated API, cloud, SSH and Kubernetes credentials.

What Happened

Agentic Threat Tracker reports a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden prompt injection instructions in web pages or source files allowed attackers to rewrite Kiro's MCP server configuration or allowlist arbitrary Bash commands, leading to arbitrary code execution on developers' machines without approval prompts.[9] The same feed details a supply chain attack where trojanized LiteLLM releases on PyPI exfiltrated model API keys, cloud access keys, SSH keys, and Kubernetes tokens, illustrating AI tooling and library supply chain risks for organizations relying on open-source LLM gateways.[9]

Affected Products

  • AWS Kiro
  • LiteLLM

Vulnerability / Attack Technique

Prompt injection rewriting agent configuration; trojanized package releases

Technical Mechanism

Injected instructions caused Kiro to change its own MCP configuration or command allowlist, after which attacker commands ran without prompts. Separately, malicious LiteLLM versions stole credentials on install.

AI Security Category

LLM01:2025 Prompt Injection

Part of the Prompt Injection topic.

Part of the MCP Security topic.

Relevant Frameworks

LLM01:2025 Prompt InjectionLLM03:2025 Supply ChainLLM06:2025 Excessive AgencyMITRE ATLAS: ExecutionMITRE ATLAS: Credential Access

RealGround Analysis

An agent that can edit its own allowlist has no allowlist. RealGround analysis: agent configuration must be outside the agent's write access, and AI gateway packages need pinning and verification.

Recommended Controls

  • Update Kiro and make its configuration read-only to the agent
  • Pin LiteLLM to verified versions and rotate any exposed credentials
  • Review allowlisted commands for coding agents

Related RealGround Service

Secure AI Agent Build · or start with the free AI Agent Security Scanner.

Sources

Agentic Threat Tracker / Whiteintel: https://agentic-threat-tracker.com/?itemType=incident

Summary and analysis written by RealGround from the source above; last updated 2026-10-17.

Talk to AI CISO