Answer Brief
A vulnerability in AWS Kiro allowed a poisoned web page to rewrite the IDE's configuration and execute arbitrary code on developer machines without approval, exploiting a flaw in how the agent handles Model Context Protocol server definitions. AWS has patched the issue in version 0.11.130 and later, though no CVE has been assigned.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Johann Rehberger demonstrated mcp.json write-to-execution flaw in Kiro on release day
- 2
Intezer reported the flaw via HackerOne
- 3
AWS stated the fix had shipped in its latest release
- 4
The Hacker News published details of the vulnerability; no CVE assigned as of this date
Executive Summary: A vulnerability in AWS Kiro allowed a poisoned web page to rewrite the IDE's configuration and execute arbitrary code on developer machines without approval, exploiting a flaw in how the agent handles Model Context Protocol server definitions. AWS has patched the issue in version 0.11.130 and later, though no CVE has been assigned.
Why It Matters
The vulnerability in AWS Kiro represents a critical failure in the security model of agentic AI tools that interact with the open web. At its core, the flaw exploited the agent’s ability to write to its own configuration file—specifically mcp.json, which governs which external Model Context Protocol servers Kiro loads and executes. Unlike traditional software where configuration changes require explicit user approval, Kiro’s design allowed the agent to modify this file autonomously using its fsWrite tool, then automatically reload it and launch the defined servers—all without meaningful developer oversight. This created a direct path from prompt injection via hidden web content to remote code execution on the developer’s machine, with the attacker’s code running under the user’s privileges. The attack vector was unusually simple: a one-pixel white text block on an otherwise benign API documentation page contained instructions for Kiro to treat the content as a setup task. When a developer asked Kiro to summarize or fetch the page, the agent parsed the hidden text, wrote a malicious server entry to mcp.json, and triggered a reload. Within seconds, the rogue server began executing—Intezer’s proof of concept only beaconed basic system information, but the same mechanism could have stolen credentials, source code, or established persistence. The researchers noted the exploit was not 100% reliable due to model non-determinism, but required only one success to compromise a system. This flaw is not new to Kiro. A nearly identical technique was demonstrated by Johann Rehberger on the tool’s release day in July 2025, where he injected code into mcp.json and .vscode/settings.json. AWS responded with version 0.1.42, adding approval prompts for such writes—but only in Supervised mode. The default Autopilot mode, which most users employ, remained vulnerable, allowing silent file writes and execution. Intezer’s 2026 finding confirmed that the original flaw persisted in versions 0.9.2 and 0.10.16, even after the 2025 partial fix. AWS’s eventual solution, implemented in version 0.11.130, shifted trust from the model to the platform. Kiro now treats mcp.json, .vscode/tasks.json, .git directories, and other sensitive files as protected paths, requiring explicit approval before any write—regardless of whether the agent is in Autopilot or Supervised mode. This change effectively closes the loop: even if the model is tricked into attempting a dangerous action, the platform enforces the boundary. AWS’s documentation reinforces this, stating that "Supervised mode is a code review workflow, not a security control," and the 1.0 release further strengthens this with a capability-based permissions model. The absence of a CVE for this vulnerability is notable but not unprecedented in the timeline. The similar 2025 flaw received CVE-2026-10591, but no identifier has been assigned to the 2026 mcp.json chain despite confirmation of patching and public disclosure. AWS has not explained why, and The Hacker News noted it had reached out for clarification. This lack of formal tracking may hinder vulnerability management efforts, especially in enterprise environments that rely on CVE-based scanning and patch prioritization. The broader implication extends beyond Kiro. In December 2025, researchers documented over 30 similar flaws across AI coding tools including Cursor and Copilot, where legitimate features like documentation search or folder opening were turned into prompt-injection vectors for code execution or data theft. The recurring pattern shows that as AI agents gain deeper access to local files, shells, and networks, the assumption that a "human in the loop" provides sufficient security is dangerously flawed—unless the platform enforces controls independently of model behavior. For security and operations teams, this case underscores the need to treat AI coding assistants as privileged endpoints. Monitoring should focus on unexpected writes to configuration files like mcp.json, .vscode/tasks.json, or shell profile scripts, particularly when triggered by web-fetched content. Organizations using such tools should enforce updates to patched versions, restrict agent permissions via platform-level controls, and consider network-level egress monitoring to detect beaconing or exfiltration attempts. Ultimately, the incident reaffirms that in agentic AI systems, security must be enforced at the platform layer—not left to the unpredictability of model behavior or user vigilance.
Event Type: security
Importance: high
Affected Companies
- AWS
- Intezer
- Kodem Security
Affected Sectors
- AI security
- application security
- cloud security
- developer tools
Key Numbers
- AWS Kiro version where flaw was patched: 0.11.130
- Latest Kiro version as of July 21, 2026: 1.0.165
- CVSS score for similar 2025 flaw (CVE-2026-10591): 8.8 (CVSS 3.1), 8.6 (CVSS 4.0)
Timeline
- Johann Rehberger demonstrated mcp.json write-to-execution flaw in Kiro on release day
- Intezer reported the flaw via HackerOne
- AWS stated the fix had shipped in its latest release
- The Hacker News published details of the vulnerability; no CVE assigned as of this date
- Current builds on 1.0.x line; 1.0.165 listed as latest
Frequently Asked Questions
How did the AWS Kiro vulnerability allow remote code execution?
The flaw allowed a poisoned web page with hidden text to manipulate Kiro into writing a malicious Model Context Protocol (MCP) server entry to its mcp.json configuration file. Once written, Kiro automatically reloaded the file and executed the server’s start command with developer privileges, bypassing any approval step.
Was user approval effective in preventing the exploit in AWS Kiro?
No. Although Kiro sometimes showed a pop-up warning about MCP configuration changes, the file was reloaded and the malicious server executed regardless of what the developer clicked, rendering the approval step ineffective.
Has AWS assigned a CVE to the Kiro vulnerability disclosed in July 2026?
No. As of July 21, 2026, no CVE has been assigned to this flaw, despite confirmation by researchers and patching in version 0.11.130. AWS has not published a complete list of affected builds.
Which versions of AWS Kiro were affected by the mcp.json write flaw?
Versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) were confirmed vulnerable when Intezer reported the issue in February 2026. The flaw was patched in version 0.11.130, which added protected-paths enforcement for mcp.json and similar files in both Autopilot and Supervised modes.
What should developers using AWS Kiro do to mitigate this risk?
Developers should update to AWS Kiro version 0.11.130 or later, preferably the current 1.0.165, where the protected-paths mechanism prevents unauthorized writes to mcp.json, .vscode/tasks.json, and other sensitive files regardless of operating mode.