Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)

Key facts for AWS Kiro mcp.json prompt injection

Detection coverage for AWS Kiro mcp.json prompt injection

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1631 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthorized Write to Kiro IDE mcp.json Outside Kiro Process

Detects a create/modify event on ~/.kiro/settings/mcp.json or a workspace .kiro/settings/mcp.json where the writing process is not the legitimate Kiro.exe/kiro binary — the observable footprint of the Intezer indirect-prompt-injection exploit chain that hijacks Kiro's fsWrite tool to register a rogue MCP server.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1554, T1546
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint_deviceFileEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\\.kiro\\settings\\mcp\.json$")
| where NOT match(Image, "(?i)\\Kiro\.exe$")
| eval risk_reason="non-Kiro process wrote mcp.json"
| table _time, ComputerName, User, Image, TargetFilename, risk_reason
| sort -_time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "mcp.json" and FolderPath has ".kiro/settings"
| where InitiatingProcessFileName !~ "kiro.exe" and InitiatingProcessFileName !~ "Kiro.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FolderPath, FileName, ActionType

Sigma

title: Unauthorized Write to Kiro IDE MCP Server Configuration (mcp.json)
id: 8f3b1a2e-6f1a-4c9e-9d3e-1a2b3c4d5e6f
status: experimental
description: Detects a write to Kiro's mcp.json MCP-server registry performed by a process other than the Kiro IDE binary itself, consistent with the indirect prompt-injection to RCE exploit chain.
references:
    - https://cybersecuritynews.com/aws-kiro-remote-code-execution/
    - https://www.kodemsecurity.com/resources/aws-kiro-agentic-ide-rce-prompt-injection-mcp-config-vulnerability
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.persistence
    - attack.t1554
    - attack.t1546
    - attack.privilege_escalation
    - attack.t1548
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\.kiro\settings\mcp.json'
    filter_known_ide_process:
        Image|endswith: '\Kiro.exe'
    condition: selection and not filter_known_ide_process
falsepositives:
    - Legitimate Kiro auto-update or first-run initialization writing mcp.json under its own process
level: high

Known false positives:

• Kiro's own installer/updater or an admin-run configuration script legitimately (re)writing mcp.json under a signed non-Kiro.exe helper process

Tuning notes: Add an allowlist of signed Kiro helper binaries (installer/updater) by hash or code-signing thumbprint to avoid alerting on legitimate patch installs; extend the path match to cover Linux/macOS home directories.

• 🔒 Hidden CSS Prompt-Injection Payload Fetched by Agentic IDE Web-Fetch Tool · unlock with TL Creds
• 🔒 Unauthorized Auto-Run Task Injected into [indicator] (folderOpen Trigger) · unlock with TL Creds
• 🔒 Periodic Low-Interval HTTP Beacon from IDE-Spawned Interpreter Process · unlock with TL Creds
• 🔒 Kiro mcp.json Modified Immediately Following Web-Fetch/Summarize Tool Call · unlock with TL Creds
• 🔒 MCP Server Registration Referencing Inline Interpreter One-Liner Command · unlock with TL Creds
• 🔒 System Discovery Data Embedded in Outbound Query String from IDE-Spawned Process · unlock with TL Creds
• 🔒 Kiro trustedCommands Wildcard Allowlist Written to [indicator] · unlock with TL Creds
• 🔒 Interpreter Child Process Spawned by Kiro IDE Following Web Fetch (MCP C2 Beacon) · unlock with TL Creds

Indicators of compromise for AWS Kiro mcp.json prompt injection

As of 2026-07-22, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1631.

How AWS Kiro mcp.json prompt injection works

A working proof of concept exfiltrated hostname, username, and platform data over HTTP; AWS shipped a permanent fix in Kiro v0.11.130 that protects mcp.json (and related sensitive paths) from unapproved agent writes across all trust modes.

AWS Kiro is an agentic, AI-powered IDE that can autonomously fetch and summarize web content, edit files, and register Model Context Protocol (MCP) servers to extend its own tool surface. Because large language models process untrusted document content and trusted user instructions through the same channel, Kiro's page-fetch/summarize feature was susceptible to indirect prompt injection: an attacker-controlled web page could embed instructions invisible to a human reader (rendered as white text at 1-pixel font size on a white background) that Kiro's model would nonetheless parse and act on with the same authority as the developer's own request.

Independent researcher teams (Nicole Fishbein at Intezer, and Eran Segal at Kodem Security) both found that Kiro's `fsWrite` file-write tool could be directed by injected instructions to create or modify `~/.kiro/settings/mcp.json` — Kiro's per-user Model Context Protocol server registry — without triggering the human-in-the-loop approval gate that is supposed to cover risky agent actions. Kiro automatically detects changes to mcp.json and hot-reloads it, immediately starting any newly registered MCP server. By writing an `mcpServers` entry whose `command`/`args` launch an attacker-controlled Node.js (or Python) one-liner, the attacker achieves full arbitrary code execution in the developer's local environment — a complete bypass of Kiro's approval-based security model using only the single, innocuous-looking permission the developer actually granted: "fetch and summarize this URL."

Intezer's proof of concept embedded an instruction in an ordinary API-documentation page telling Kiro to write an mcp.json entry starting a Node.js server that runs `setInterval` every 10 seconds, gathering `os.hostname()`, `os.userInfo().username`, and `os.platform()` and exfiltrating them via an HTTP GET request to an attacker-controlled listener. The listener logged "TELEMETRY RECEIVED — CODE EXECUTION CONFIRMED" on receipt, demonstrating a complete, repeatable exploit chain from a single web-fetch action to remote code execution and beaconing. The same technique generalizes to credential theft, source-code exfiltration, or lateral movement, since the injected MCP server runs with the full privileges of the developer's own session.

Kodem Security independently identified a second variant of the same root cause: injected instructions could direct Kiro's `edit_file`/`file_edit` tools to modify `.vscode/settings.json`, setting `kiroAgent.trustedCommands` to a wildcard allowlist (`["*"]`), after which the agent could run arbitrary bash commands (demonstrated with a benign `open -a Calculator.app` PoC) without further approval. This is architecturally the same failure — an AI agent using its file-write capability to rewrite the very security configuration meant to constrain it — and was tracked separately by AWS as CVE-2026-10591 ("Insufficient access control restrictions in the file write tool in Kiro IDE", affecting versions prior to 0.11, targeting execution-sensitive paths such as .vscode/tasks.json).

This is the third publicly reported iteration of this bug class in Kiro: an initial mcp.json write-to-execution flaw was reported in July 2025 shortly after Kiro's release (patched in v0.1.42, no CVE issued) with only a partial fix that added approval prompts solely in "Supervised" mode — which Intezer noted AWS's own documentation describes as "a code review workflow, not a security control." The February–April 2026 research cycle covered in this threat represents the permanent fix, which AWS confirmed protects mcp.json (and related sensitive paths: .vscode/tasks.json, .git) from unapproved writes across ALL trust modes, not just Supervised mode.

No CVE has been assigned to the core mcp.json prompt-injection-to-RCE finding as of July 21, 2026, and AWS did not publish a complete list of affected build numbers — meaning automated vulnerability scanners keyed on CVE identifiers would not have flagged unpatched Kiro installs. Researchers have separately catalogued more than 30 related prompt-injection/config-rewrite flaws across other agentic coding tools (including Cursor and GitHub Copilot) as of December 2025, indicating this is a systemic risk pattern for AI-driven IDEs and coding agents that combine autonomous file-write capability with consumption of untrusted external content.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1189 Drive-by Compromise

execution

T1204 User Execution

Persistence

T1546 Event Triggered Execution; T1554 Compromise Host Software Binary

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Impact

T1565 Data Manipulation

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Remediation for AWS Kiro mcp.json prompt injection

Patches

• Kiro v0.11.130 protects ~/.kiro/settings/mcp.json (and related sensitive config paths) from unapproved agent writes across all trust modes
• CVE-2026-10591 fixed in Kiro IDE 0.11: adds access-control restrictions to the file-write tool for execution-sensitive paths such as .vscode/tasks.json

Immediate actions

• Upgrade AWS Kiro to version 0.11.130 or later (current line is 1.0.x, latest 1.0.165 as of 2026-07-21)
• Audit ~/.kiro/settings/mcp.json and any workspace .kiro/settings/mcp.json for unrecognized mcpServers entries
• Restrict file permissions on mcp.json (chmod 600) at both user and workspace scope per Kiro's own MCP security guidance
• Review .vscode/settings.json for unexpected kiroAgent.trustedCommands wildcard entries ("*") and .vscode/tasks.json for injected auto-run tasks
• Treat any Kiro session that fetched/summarized untrusted external web content prior to patching as potentially compromised; inspect for unauthorized outbound network connections from IDE-spawned child processes

Workarounds

• Disable or restrict Kiro's autonomous web-fetch/summarize feature until upgraded
• Manually set restrictive file permissions on mcp.json and .vscode/settings.json/tasks.json
• Run Kiro in an isolated/sandboxed environment without direct access to sensitive credentials or source repositories until patched

Longer-term hardening

• Enforce system-level (not model-behavior-level) controls on which files an AI coding agent may write without explicit human approval
• Treat all MCP servers as third-party code: verify provenance, review source, and avoid auto-approving MCP servers introduced via agent-initiated file writes
• Do not rely on IDE 'Supervised'/code-review modes as a security boundary — require approval prompts enforced platform-wide across every operating mode
• Apply content-security hygiene to any agentic tool that ingests untrusted external content (web pages, PRs, issues, uploaded files): treat fetched content as data, not instructions, and sandbox/segregate the channel that can trigger file writes or command execution
• Extend monitoring/EDR coverage on developer workstations to flag unexpected child processes (node/python) spawned by IDE processes and unsolicited outbound beacons from IDE-associated PIDs

Affected and fixed versions

• Amazon Web Services (AWS) — Kiro IDE
  Vulnerable versions: 0.9.2 (macOS arm64); 0.10.16 (Ubuntu x86); all versions prior to 0.11.130
  Fixed in: 0.11.130; 1.0.x line (latest observed 1.0.165 as of 2026-07-21)

Timeline of AWS Kiro mcp.json prompt injection

• 2025-07-15 Initial mcp.json write-to-execution flaw reported to AWS on Kiro's public release day (Embrace The Red / researcher disclosure).
• 2025-08-05 AWS patches the initial vulnerability class in Kiro v0.1.42, adding approval prompts limited to 'Supervised' mode.
• 2025-08-26 Public disclosure of the indirect prompt injection / arbitrary command execution technique via Embrace The Red blog, documenting the locked-ioc-12 trustedCommands wildcard and mcp.json Python server attack paths.
• 2026-02-11 Nicole Fishbein (Intezer) reports the persistent mcp.json prompt-injection-to-RCE flaw to AWS via HackerOne.
• 2026-03-06 Finding escalated to the AWS Vulnerability Disclosure Program (VDP) team after initial triage.
• 2026-04-03 Related CVE-2026-10591 (insufficient file-write access control on execution-sensitive paths such as locked-ioc-14) fixed in Kiro IDE 0.11.
• 2026-04-03 AWS confirms a permanent fix has shipped; researchers independently verify the fix is present in Kiro v0.11.130, protecting mcp.json and related sensitive paths across all trust modes.
• 2026-07-21 Reporting confirms AWS has not assigned a CVE to the core mcp.json prompt-injection RCE finding and has not published a full list of affected build numbers; current Kiro release line is 1.0.x (latest 1.0.165).
• 2026-07-22 Cyber Security News, The Hacker News, and Tech Times publish coverage summarizing the Intezer/Kodem research and AWS's response.

Sources cited for AWS Kiro mcp.json prompt injection

• Amazon Q Developer and Kiro – Prompt Injection Issues in Kiro and Q IDE plugins aws.amazon.com · Advisory · 2025-08-05
• CVE-2026-10591 - Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths aws.amazon.com · Advisory · 2026-04-03
• Arbitrary code execution via crafted project files in Kiro IDE aws.amazon.com · Advisory · 2026-02-01
• AWS Kiro RCE: Prompt Injection to Code Execution kodemsecurity.com · Vendor report · 2026-07-01
• AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection embracethered.com · Research · 2025-08-26
• Kiro MCP Security Best Practices kiro.dev · Vendor report · 2026-01-01
• When AI Tools Become the Backdoor: Zero-Click RCE via Prompt Injection cymulate.com · Research · 2026-01-15
• AWS Kiro Remote Code Execution Vulnerability cybersecuritynews.com · News · 2026-07-22
• AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code The Hacker News · News · 2026-07-22
• Hidden Web Text Hijacked Kiro and Ran Attacker Code: AWS Confirms No CVE Assigned techtimes.com · News · 2026-07-22

Threats related to AWS Kiro mcp.json prompt injection

• Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq
• CVE-2026-21523: TOCTOU Race Condition in GitHub Copilot / Visual Studio Enables Authorized Network Code Execution
• Cursor AI Code Editor Autorun Flaw Enables Silent Code Execution via Malicious Repositories
• Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
• PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2

Previous and next in vulnerability

• RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600) Previous report
• CVE-2026-8933: Race Condition in Ubuntu snap-confine Enables Local Privilege Escalation to Root Next report

Further reading

• CrowdStrike Prompt Injection Taxonomy for LLMs