Critical AWS Kiro RCE Vulnerability Found in Website Text

Key Takeaways

• A critical remote code execution (RCE) vulnerability was discovered in AWS Kiro, an AI-powered Integrated Development Environment (IDE).
• The flaw allows attackers to execute arbitrary code on a developer’s machine through hidden text embedded in seemingly innocuous web content.
• The vulnerability bypasses Kiro’s “human-in-the-loop” security model, performing malicious actions without explicit user approval.
• AWS has released a fix for this issue in Kiro version 0.11.130, though no CVE has been assigned.

A significant security flaw has been uncovered in AWS Kiro, an AI-driven Integrated Development Environment, demonstrating how concealed text on a webpage can lead to remote code execution on a developer’s system. This vulnerability effectively circumvents Kiro’s established security protocols, which are designed to prevent unauthorized actions.

Kiro operates on a principle where human oversight is critical, requiring explicit user consent for potentially risky operations, such as executing shell commands or altering sensitive files. This mechanism is intended to ensure developers retain control over AI-initiated actions.

However, security researchers have illustrated that this protective boundary can be bypassed silently through a prompt injection attack originating from external content. The root cause of this vulnerability lies in how large language models (LLMs) process incoming data.

Unlike conventional software systems that maintain a clear distinction between data and executable instructions, LLMs interpret all input as potential commands, making them susceptible to prompt injection attacks.

Hidden Web Text Enables AWS Kiro RCE

In the context of Kiro, this risk is compounded by overly permissive access rights and inadequate protection of vital configuration files. A central component of this vulnerability is the Model Context Protocol (MCP) configuration file, located at ~/.kiro/settings/mcp.json, which dictates the external tools Kiro can use and their associated commands.

Kiro automatically reloads and executes any commands specified in this file whenever it detects a modification. Researchers found that this MCP file is not adequately protected, allowing the AI agent to modify its contents using internal tools without requiring user approval.

An attacker can leverage this by embedding covert instructions within seemingly harmless web content. For instance, if a developer instructs Kiro to summarize documentation or retrieve a webpage, and that page contains hidden prompt injection payloads, Kiro will still process and act upon these concealed directives.

During a proof-of-concept attack, a user fetched external content, and Kiro subsequently processed both the visible and hidden text. The injected instructions then commanded Kiro to overwrite the MCP configuration file with malicious content.

This process registers a server designed to execute arbitrary code on the host system. Once the MCP file is altered, Kiro automatically reloads and runs the malicious payload, all without the developer’s knowledge or explicit consent.

The proof-of-concept demonstrated how attackers could deploy a lightweight Node.js payload to exfiltrate system information, including hostname, username, and platform details, to a remote server. While this demonstration focused on benign data collection, the same technique could be employed for more nefarious purposes, such as stealing credentials or accessing sensitive source code.

Crucially, the user remains oblivious to the compromise, believing they merely approved a standard web request. No warnings are displayed regarding file modifications or code execution, and existing security prompts concerning configuration changes fail to prevent the malicious activity.

According to Nicole Fishbein of Intezer Research, this vulnerability underscores the inherent weakness of relying solely on user approval as a security boundary in AI-powered applications. If an AI agent can alter its execution environment without robust safeguards, the fundamental trust model breaks down.

This risk is particularly alarming when the IDE has access to sensitive credentials or production infrastructure. AWS has since addressed this issue in newer Kiro versions, with fixes confirmed in version 0.11.130. However, no CVE identifier has been assigned for this vulnerability.

This incident highlights the urgent need for enhanced security measures, particularly around critical configuration files and stringent controls over high-risk actions. As AI agents become increasingly integrated into development workflows, this case serves as a stark reminder that security controls must be enforced at the system level, not solely through the AI model’s behavior. Even a single, invisible line of text can transform a helpful coding assistant into a silent vector for malicious code execution.

What You Should Do

• Update AWS Kiro to version 0.11.130 or later immediately to apply the patch for this vulnerability.
• Exercise extreme caution when instructing AI-powered IDEs to process external or untrusted web content.
• Regularly review and audit the permissions granted to AI agents and development tools, ensuring they adhere to the principle of least privilege.
• Implement robust system-level security controls that prevent unauthorized modification of critical configuration files, independent of AI agent behavior.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.