Hidden Web Instructions Made Kiro Run Attacker Code in Tests

Researchers found that hidden instructions on a web page could make older versions of AWS’s Kiro coding environment rewrite its Model Context Protocol configuration and run attacker-controlled code. The developer approved a page fetch, an ordinary action for a coding agent. Kiro handled the configuration change and process launch without showing an approval prompt for either step.

Intezer published the research on July 20 in collaboration with Kodem Security. Their proof of concept targeted ~/.kiro/settings/mcp.json, the file that lists MCP servers and the commands used to start them. The researchers tested Kiro 0.9.2 and 0.10.16, then confirmed that the chain failed in 0.11.130 after AWS deployed a fix.

AWS tracks insufficient file-write restrictions in Kiro before version 0.11 as CVE-2026-10591. Its bulletin describes crafted instructions writing to execution-sensitive paths and recommends upgrading to the latest release. The bulletin uses .vscode/tasks.json as an example rather than documenting the MCP chain, so the narrower mcp.json details come from Intezer and Kodem.

A routine fetch reached the MCP configuration

Intezer and Kodem’s proof of concept served what looked like an API documentation page. A one-pixel block of white text in the HTML told Kiro to create a new MCP server named telemetry. The server command used Node.js to send the machine’s hostname, username and operating-system platform to a listener every ten seconds.

The researchers kept the callback on localhost and exposed no real users to the page. Their purpose was to demonstrate the execution path. Kiro fetched the page after the developer approved access to an unfamiliar URL, read the hidden instructions, wrote the MCP configuration and reloaded it. The newly defined command then ran with the developer’s privileges.

Kiro’s behavior was not perfectly deterministic. Intezer reported that the model sometimes summarized the page or followed only part of the injected instruction. In testing, the attack succeeded within one or two attempts. That uncertainty affects reliability, but a single successful run is enough to execute code.

The root problem sat below the model. Kiro could write to mcp.json through its file tool without a separate approval, even though the file defined commands that the application would start. Some runs displayed a notice that the MCP configuration had changed. According to the researchers, Kiro reloaded the file regardless of the response to that notice.

Approval covered the harmless action

Human approval can work only when the prompt describes the action carrying the risk. Here, the developer decided whether Kiro could fetch documentation. The prompt did not ask whether an external page could add a local MCP server or start a Node.js process.

That mismatch is important for any tool that allows an agent to read untrusted material and alter its own capabilities. A page fetch may be low risk on its own. An edit to a file that grants execution authority is a different decision, even when the agent reaches it while completing the approved task.

Prompt injection supplied the instructions, but model behavior alone did not produce code execution. The application also exposed a writable configuration path and automatically acted on the result. A more obedient model would not be a durable fix because external text and instructions share the same context. The reliable control belongs at the file-write and process-launch layers.

Files that grant authority deserve separate controls

MCP definitions are executable configuration. They may look like JSON settings, but their command and argument fields determine which programs run under the user’s account. Task files, hooks and extension settings can carry similar authority.

Agent platforms should classify those paths separately from ordinary project files. A write should require an approval that shows the exact path and the meaningful change, followed by another enforced decision before a new command runs. Rejecting the prompt must leave the prior configuration in place.

The same rule should survive changes in agent mode. Autopilot features, trusted workspaces and broad file permissions cannot silently remove protection from execution-sensitive paths. An organization may choose different defaults for each workflow, but the boundary has to be implemented by the host application rather than delegated to the model.

Tool scope also deserves attention. A review task rarely needs permission to install an MCP server. Documentation lookup should not inherit every capability used for local build automation. Narrowing the available tools reduces the number of ways an injected instruction can reach a privileged action.

Checks for teams running coding agents

Kiro users should confirm that their installations are on version 0.11 or later, with the latest available release preferred. AWS lists all versions before 0.11 as affected by CVE-2026-10591 and provides no workaround.

Security teams can inventory files that change what an agent may execute, then test whether those paths remain protected in each supported operating mode. The review should include MCP configuration, editor task definitions, hooks, command allowlists and environment settings that influence process startup.

Telemetry needs to connect the agent’s request to the resulting host activity. Useful records include the fetched source, sensitive file writes, configuration reloads and child processes. Endpoint data may reveal that Node.js started, while an agent trace can explain which page supplied the instruction and why the application accepted it.

The Kiro flaw turned a routine fetch into local execution because approval was attached to the first step instead of the authority change. Agent platforms will keep processing hostile text as part of legitimate work. Security depends on keeping that text away from protected configuration unless the user sees and accepts the exact consequence.