AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
A security flaw in AWS Kiro, an AI coding assistant, allowed an attacker to rewrite its configuration file and execute arbitrary code on a developer's machine simply by inserting malicious text into a seemingly innocuous API documentation page. Despite previous fixes and a similar vulnerability discovered in 2025, AWS has not assigned a CVE. The issue stemmed from Kiro's design, which trusts its model's judgment on sensitive files, leading to a need for a human-in-the-loop approach to prevent exploitation.
A security flaw in AWS Kiro, an AI coding assistant, has been discovered that allows an attacker to execute arbitrary code on a developer's machine. Researchers at Intezer, in collaboration with Kodem Security, found that a simple request to summarize a web page could lead to a poisoned web page being injected, which then rewrites Kiro's configuration file and runs attacker-supplied code. The vulnerability stems from Kiro's reliance on a human-in-the-loop approval process, where the agent trusts its model's judgment on sensitive files like `mcp.json` and `.vscode/settings.json`.
Previous research in 2025 identified a similar issue, and AWS addressed it with a fix in Kiro 0.11, but only in Supervised mode. Intezer's research demonstrated that the attack remained viable in Autopilot mode, where Kiro automatically rewrites the configuration file without prompting for approval. The flaw was replicated across multiple versions, including 0.9.2 (macOS) and 0.10.16 (Ubuntu), and was confirmed patched in v0.11.130.
AWS's current solution involves marking sensitive files as protected paths, requiring explicit approval before any write operation, regardless of the mode (Supervised or Autopilot). The Hacker News reached out to AWS for confirmation of affected Kiro versions and why no CVE was assigned, and will update this story with any response. This vulnerability highlights a broader trend of AI coding tools incorporating legitimate editor features that can be exploited through prompt injection, as evidenced by similar flaws found in tools like Cursor and Copilot. The key takeaway is that control must reside within the platform, enforced at every stage, to prevent AI models from overriding essential security measures.