A Hidden Line of Website Text Can Turn AWS Kiro Into a Remote Code Execution Tool

A recently disclosed vulnerability in AWS Kiro, an AI-powered Integrated Development Environment (IDE), reveals how a hidden line of text on a webpage can be exploited for remote code execution on a developer’s machine, bypassing the platform’s security model.

Kiro operates on a “human-in-the-loop” principle, requiring user approval for potentially dangerous actions like executing shell commands or modifying sensitive files. This approval aims to maintain human control over AI actions.

However, researchers have shown that this security boundary can be silently bypassed via a prompt injection attack from external content. The vulnerability stems from how large language models (LLMs) process input.

Unlike traditional systems that clearly separate data and executable instructions, LLMs treat all input as potential commands, making prompt injection a significant risk.

Hidden Website Text Triggers AWS Kiro RCE

In Kiro’s case, this risk is exacerbated by excessive permissions and poor protection of critical configuration files. Central to this vulnerability is the Model Context Protocol configuration file located at ~/.kiro/settings/mcp.json, which defines external tools and their commands.

Kiro automatically reloads and executes any commands in this file whenever it’s modified. Researchers found that this file is unprotected and can be altered by the AI agent using internal tools without user approval.

An attacker can exploit this by embedding hidden instructions into seemingly harmless web content. For example, when a developer requests Kiro to summarize documentation or fetch a webpage, if that page includes concealed prompt injection payloads, Kiro will still act on those instructions.

In a demonstrated attack sequence, a user fetches external content, and Kiro processes both visible and hidden text. The injected instructions direct Kiro to overwrite the MCP configuration file with malicious content.

This registers a server executing arbitrary host system code. Once modified, Kiro automatically reloads and runs the payload, all without user awareness.

A proof-of-concept exploit showed how attackers could deploy a lightweight Node.js payload to exfiltrate system information like hostname, username, and platform details to a remote server.

Although the demonstration was limited to benign data collection, the same method could be used to steal credentials or access source code.

Importantly, the user remains unaware of the breach, believing they’ve only approved a routine web request. No warnings are displayed about file modifications or code execution, and security prompts regarding configuration changes fail to prevent malicious activity.

According to Nicole Fishbein of Intezer Research, the vulnerability highlights the weakness of treating user approval as a security boundary in AI-powered tools. If an AI agent can modify its execution environment without adequate safeguards, the underlying trust model breaks down.

This risk is particularly concerning when the IDE has access to sensitive credentials or production infrastructure. AWS has addressed this issue in later Kiro versions, with fixes confirmed in version 0.11.130 however, no CVE identifier is assigned.

This incident highlights the urgent need for stronger safeguards, especially around critical configuration files and controls on high-risk actions.

As AI agents become further integrated into development workflows, this case serves as a reminder that security controls must be enforced at the system level, not solely through model behavior. Even an invisible line of text can turn a helpful coding assistant into a silent execution vector.

According to the AWS team speaking with Cyber Security News Editorial, On June 2, 2026, “we published and addressed the Autopilot issue in Security Bulletin 2026-037-aws, where we assigned CVE-2026-10591. Please note, this was related to the class of issue described in Security Bulletin AWS-2025-019. The 2025 remediation (Kiro 0.1.42) required human-in-the-loop confirmation for modifying in Supervised mode only. The default Autopilot mode was addressed in the 2026 remediation as a separate issue.”

If you refer to Security Bulletin 2026-037-aws and the corresponding CVE record, we describe the issue as “Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands.”

The Kiro versions that were affected by this issue include all versions before 0.11.34. We can confirm that the 0.11.34 release was the first to add mcp.json to the protected-paths list.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment