AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been

According to the report, a flaw in AWS Kiro’s agentic IDE allowed *hidden text on a web page* to indirectly influence the agent so that it rewrote its own configuration file (mcp.json) and executed attacker-controlled code on a developer’s machine without any effective approval step.[5][11] The issue affected specific Kiro versions (e.g., 0.9.2 on macOS and 0.10.16 on Ubuntu) and has since been patched by AWS, with newer releases requiring explicit approval before changes to sensitive configuration files.[11] From a RealGround perspective, this is a textbook indirect prompt injection and AI agent abuse case, where untrusted external content (web pages) is treated as trusted context by an autonomous coding agent, enabling self-reconfiguration and RCE. Practically, organizations need stronger guardrails for file- and config-modifying tools, explicit trust boundaries around all external data sources, sandboxed execution for AI-driven actions, and continuous red teaming of agent behaviors to catch these cross-context escalation paths early.