Cases › security breach › LR-2026-0615

Hidden web text hijacks AWS Kiro IDE to run attacker code

Confirmed Why: 3 independent outlets · 3 independent reports

Status: fix reported

Severity minor

Reported 21 Jul 2026

Developer and model AWS

Could do shell commands, fetch URLs, edit files

No source states: loss or records, agent tool, deployer, industry.

Severity minor: test: contained to the research setup with no third party touched, since the callback was kept on localhost so no real Kiro users were exposed

Intezer, working with Kodem Security, found that AWS's agentic coding IDE Kiro could be steered by hidden text on a web page. Kiro could write its MCP server configuration file, mcp.json, without approval, and the file reloaded automatically, launching whatever command it described on the developer's machine. In Intezer's proof of concept, one-pixel white text on an API documentation page instructed Kiro to register a rogue server, which ran attacker code when the developer asked Kiro to summarize the page. The researchers reported the flaw to AWS in February 2026 and confirmed the fix in version 0.11.130. Their callback pointed to localhost, so no real users were exposed. AWS later added protected paths that require approval before writes to sensitive files, including mcp.json.

What happened

1 · What it was doingKiro, an agentic coding IDE, reads outside content such as web pages when a developer asks it to fetch, read or search.

2 · What it reached or didThe rogue server started within seconds and the attacker's code ran on the developer's machine in the proof of concept.

3 · How it was caughtIntezer found the flaw and reported it to AWS through HackerOne in February 2026.

What was done

Fix reported

“Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as protected paths, each requiring explicit approval before a write.”

Human approval for high-impact actions

No later incident for AWS under this risk on record.

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week

Agent takes destructive or unapproved actions
Also63 incidents
Rising: 5 vs 2.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Outside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list

Application

Human approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use

Similar incidents

Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage2026-02-20

Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources2025-07-23

Public-facing AWS agent could read, rewrite or delete other agents in its region (Amazon Bedrock AgentCore)2026-10-09

AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS2026-10-10

All cases of this kind ›

Evidence

Cause a safeguard that was in place did not hold
What set it off hidden instructions in its input
What was done Protected paths for mcp.json and other sensitive files, each requiring explicit approval before a write

No source states: what went wrong, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

2025-07 Johann Rehberger showed the same mcp.json write-to-execution route on Kiro's release day, an earlier related finding.
2026-02-11 Intezer reported the vulnerability to AWS through HackerOne.
2026-04-03 AWS confirmed the fix shipped in the latest Kiro release without specifying the version.
2026-07-21 Intezer and Kodem Security published the findings and the researchers confirmed the patch in v0.11.130.

Show every field, with its source and grade

The AI system

Developer

AWS

C one secondary source states it

Software around the model

agentic coding IDE

C one secondary source states it

Tools it was given

shell commands, fetch URLs, edit files

C one secondary source states it

What happened

Earliest source we hold

2026-07-21

C one secondary source states it

What set it off

hidden instructions in its input

C one secondary source states it

Who caught it

an independent researcher or journalist

C one secondary source states it

Cause

a safeguard that was in place did not hold

C one secondary source states it

Cause in detail

Kiro's fsWrite tool could write mcp.json without approval, and the file reloaded automatically

C one secondary source states it

Who was responsible

the model provider

C one secondary source states it

What was done

Protected paths for mcp.json and other sensitive files, each requiring explicit approval before a write

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

primary risk

RK01

D inferred by us from the described behaviour, reason shown

secondary risks

RK02

D inferred by us from the described behaviour, reason shown

remediations

kind: fix; controls added: B1; quote: Kiro now marks mcp.json, .vscode/tasks.json, the .git directory, and other sensitive files as protected paths, each requiring explicit approval before a write.; source index: 0

C one secondary source states it

Impact

Severity

minor

D inferred by us from the described behaviour, reason shown

Kind of harm

no harm happened

C one secondary source states it

Who was affected

Kiro IDE versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) were confirmed affected; the fix was confirmed in v0.11.130

C one secondary source states it

Why this severity

test: contained to the research setup with no third party touched, since the callback was kept on localhost so no real Kiro users were exposed

D inferred by us from the described behaviour, reason shown

Notes on gaps

Sources also differ on whether a CVE covers this issue: AWS cites CVE-2026-10591, while other reporting says none was assigned. Whether Kiro CLI or Web builds were affected is not established. Figures such as loss, records and affected counts are not stated and are left out.

LR-2026-0615 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON