Researchers at Intezer, working with Kodem Security, disclosed a remote code execution chain in AWS Kiro, Amazon’s agentic coding IDE, that starts with nothing more than asking the assistant to summarize a web page. Hidden instructions embedded in that page get read by Kiro’s model as commands, and the agent uses its own file-write tool to overwrite its Model Context Protocol configuration — silently turning “summarize this page” into arbitrary code execution on the developer’s machine. The finding was disclosed July 21, 2026, after a roughly five-month coordinated disclosure process that began in February. It’s fixed in Kiro 0.11.130; current builds are on the 1.0.x line.

The attack chain

Kiro, like other MCP-aware agents, reads the list of MCP servers it should launch — and the exact shell command used to start each one — from ~/.kiro/settings/mcp.json. That file is trusted implicitly: whatever command it specifies runs on the host with the developer’s own privileges the next time Kiro reloads its configuration.

The chain Intezer and Kodem walked through:

  1. An attacker plants hidden text on a web page — invisible to a human reader (white-on-white text, off-screen CSS, alt text, whatever renders but doesn’t display) but fully visible to the model when Kiro fetches and reads the page.
  2. A developer asks Kiro to do something completely ordinary with that page — summarize it, extract data from it, answer a question about it.
  3. The hidden instructions are indistinguishable to the model from the developer’s own request. They tell the agent to use its file-write tool to overwrite mcp.json with attacker-controlled content — a new MCP server entry whose “command” is whatever the attacker wants executed.
  4. Kiro reloads its MCP configuration and starts the new “server,” which is really just the attacker’s command running with the user’s full local privileges.

No permission dialog stood between step 3 and step 4. This is classic indirect prompt injection: the attacker never talks to the model directly, they just leave instructions somewhere the model will read them as part of its normal job.

Not the first time, and not the only Kiro RCE this cycle

Notably, this exact move — writing to mcp.json to get from prompt injection to command execution — was already demonstrated by Johann Rehberger (Embrace The Red) on Kiro’s public release day back in July 2025. It took roughly a year for AWS to ship enforced protection against it.

Kiro also picked up a second, CVE-numbered flaw in the same cycle: CVE-2026-10591 (“Insufficient File Write Restrictions to Execution-Sensitive Paths”), reported by Cymulate and scored 8.8 (CVSS 3.1) / 8.6 (CVSS 4.0). That bug let crafted instructions write auto-executing content into IDE-integration paths such as .vscode/tasks.json — so opening a poisoned project folder in Kiro was enough to trigger command execution on folder-open, no chat interaction required. It’s patched in Kiro 0.11, which added an approval requirement before Kiro’s own tools can touch protected configuration paths.

The Intezer/Kodem mcp.json chain itself has no CVE assigned — AWS confirmed there isn’t one — which means it won’t show up in the NVD-driven scanners most teams rely on to flag vulnerable software versions.

Impact

Anyone running a pre-0.11.130 Kiro build is exposed to code execution triggered purely by ordinary agent usage against untrusted content — browsing docs, summarizing a ticket, reading a scraped page, ingesting an MCP tool’s response. There’s no social-engineering step distinct from normal workflow, no malicious download, no phishing link to click. The victim’s own routine use of the tool is the delivery mechanism. Because the payload runs with the developer’s local privileges, the blast radius is whatever that developer’s machine can reach: source repos, cloud credentials, SSH keys, CI tokens, internal networks.

This sits in a growing pattern of 2026 IDE-agent RCEs — Cursor’s DuneSlide chain (CVE-2026-50548/50549) used the same “poisoned content the agent reads mid-task defeats its own guardrails” structure. Any agentic coding tool that lets a model both read untrusted content and write to its own execution-relevant configuration without a hard approval gate has this class of bug until proven otherwise.

What to do now

  • Update immediately to Kiro 0.11.130 or later (1.0.x line), which enforces approval before writes to mcp.json, .vscode/tasks.json, and other execution-sensitive paths in both Autopilot and Supervised modes.
  • Audit ~/.kiro/settings/mcp.json and any .vscode/tasks.json in projects opened in Kiro for unexpected entries, especially command strings you didn’t add yourself.
  • Don’t rely on NVD/CVE-driven scanning alone for AI coding tools — the more severe chain here has no CVE and won’t surface in a standard vulnerability feed.
  • Treat agentic IDEs as running with your full local privilege set by default. Consider running them in a container or VM with restricted filesystem and credential access, particularly if the agent is configured to browse or ingest external content autonomously.
  • Review your MCP server allowlist policy organization-wide — any tool that reloads MCP config without a diff/approval step is a standing RCE primitive waiting for the next prompt-injection vector.

References: Kodem Security — AWS Kiro RCE: Prompt Injection to Code Execution; The Hacker News coverage; AWS Security Bulletin 2026-037 (CVE-2026-10591); Embrace The Red — original mcp.json disclosure.