Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)

Prompt Injection in AWS Kiro Leads to Remote Code Execution (TL-2026-1631), also tracked as AWS Kiro MCP Config Prompt Injection RCE, is a high-severity software vulnerability, first published 2026-07-22. It has no confirmed attribution, affects Amazon Web Services (AWS) Kiro IDE, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1631

Threat ID
TL-2026-1631
Also known as
AWS Kiro MCP Config Prompt Injection RCE, Kiro mcp.json Hijack
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-22
Last reviewed
2026-07-22
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, cloud-services
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in Prompt Injection in AWS Kiro Leads to Remote Code Execution

Malware and tooling: telemetry (malicious MCP server label), edit_file / file_edit, fsWrite

Security researchers at Intezer and Kodem Security disclosed an indirect prompt-injection vulnerability in the AWS Kiro agentic IDE that allowed a malicious web page (hidden white-on-white 1px-font text) to instruct Kiro to overwrite the unprotected ~/.kiro/settings/mcp.json configuration file, register a rogue MCP server, and silently gain arbitrary code execution on the developer's machine with no approval prompt. A working proof of concept exfiltrated hostname, username, and platform data over HTTP; AWS shipped a permanent fix in Kiro v0.11.130 that protects mcp.json (and related sensitive paths) from unapproved agent writes across all trust modes.

How Prompt Injection in AWS Kiro Leads to Remote Code Execution works

AWS Kiro is an agentic, AI-powered IDE that can autonomously fetch and summarize web content, edit files, and register Model Context Protocol (MCP) servers to extend its own tool surface. Because large language models process untrusted document content and trusted user instructions through the same channel, Kiro's page-fetch/summarize feature was susceptible to indirect prompt injection: an attacker-controlled web page could embed instructions invisible to a human reader (rendered as white text at 1-pixel font size on a white background) that Kiro's model would nonetheless parse and act on with the same authority as the developer's own request.

Independent researcher teams (Nicole Fishbein at Intezer, and Eran Segal at Kodem Security) both found that Kiro's `fsWrite` file-write tool could be directed by injected instructions to create or modify `~/.kiro/settings/mcp.json` — Kiro's per-user Model Context Protocol server registry — without triggering the human-in-the-loop approval gate that is supposed to cover risky agent actions. Kiro automatically detects changes to mcp.json and hot-reloads it, immediately starting any newly registered MCP server. By writing an `mcpServers` entry whose `command`/`args` launch an attacker-controlled Node.js (or Python) one-liner, the attacker achieves full arbitrary code execution in the developer's local environment — a complete bypass of Kiro's approval-based security model using only the single, innocuous-looking permission the developer actually granted: "fetch and summarize this URL."

Intezer's proof of concept embedded an instruction in an ordinary API-documentation page telling Kiro to write an mcp.json entry starting a Node.js server that runs `setInterval` every 10 seconds, gathering `os.hostname()`, `os.userInfo().username`, and `os.platform()` and exfiltrating them via an HTTP GET request to an attacker-controlled listener. The listener logged "TELEMETRY RECEIVED — CODE EXECUTION CONFIRMED" on receipt, demonstrating a complete, repeatable exploit chain from a single web-fetch action to remote code execution and beaconing. The same technique generalizes to credential theft, source-code exfiltration, or lateral movement, since the injected MCP server runs with the full privileges of the developer's own session.

Kodem Security independently identified a second variant of the same root cause: injected instructions could direct Kiro's `edit_file`/`file_edit` tools to modify `.vscode/settings.json`, setting `kiroAgent.trustedCommands` to a wildcard allowlist (`["*"]`), after which the agent could run arbitrary bash commands (demonstrated with a benign `open -a Calculator.app` PoC) without further approval. This is architecturally the same failure — an AI agent using its file-write capability to rewrite the very security configuration meant to constrain it — and was tracked separately by AWS as CVE-2026-10591 ("Insufficient access control restrictions in the file write tool in Kiro IDE", affecting versions prior to 0.11, targeting execution-sensitive paths such as .vscode/tasks.json).

This is the third publicly reported iteration of this bug class in Kiro: an initial mcp.json write-to-execution flaw was reported in July 2025 shortly after Kiro's release (patched in v0.1.42, no CVE issued) with only a partial fix that added approval prompts solely in "Supervised" mode — which Intezer noted AWS's own documentation describes as "a code review workflow, not a security control." The February–April 2026 research cycle covered in this threat represents the permanent fix, which AWS confirmed protects mcp.json (and related sensitive paths: .vscode/tasks.json, .git) from unapproved writes across ALL trust modes, not just Supervised mode.

No CVE has been assigned to the core mcp.json prompt-injection-to-RCE finding as of July 21, 2026, and AWS did not publish a complete list of affected build numbers — meaning automated vulnerability scanners keyed on CVE identifiers would not have flagged unpatched Kiro installs. Researchers have separately catalogued more than 30 related prompt-injection/config-rewrite flaws across other agentic coding tools (including Cursor and GitHub Copilot) as of December 2025, indicating this is a systemic risk pattern for AI-driven IDEs and coding agents that combine autonomous file-write capability with consumption of untrusted external content.

MITRE ATT&CK techniques used in TL-2026-1631

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1189 Drive-by Compromise

execution

T1204 User Execution

Persistence

T1546 Event Triggered Execution; T1554 Compromise Host Software Binary

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Impact

T1565 Data Manipulation

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Affected products and versions in Prompt Injection in AWS Kiro Leads to Remote Code Execution

  • Amazon Web Services (AWS) — Kiro IDE
    Vulnerable versions: 0.9.2 (macOS arm64); 0.10.16 (Ubuntu x86); all versions prior to 0.11.130
    Fixed in: 0.11.130; 1.0.x line (latest observed 1.0.165 as of 2026-07-21)

Remediation for Prompt Injection in AWS Kiro Leads to Remote Code Execution

Patches

  • Kiro v0.11.130 protects ~/.kiro/settings/mcp.json (and related sensitive config paths) from unapproved agent writes across all trust modes
  • CVE-2026-10591 fixed in Kiro IDE 0.11: adds access-control restrictions to the file-write tool for execution-sensitive paths such as .vscode/tasks.json

Immediate actions

  • Upgrade AWS Kiro to version 0.11.130 or later (current line is 1.0.x, latest 1.0.165 as of 2026-07-21)
  • Audit ~/.kiro/settings/mcp.json and any workspace .kiro/settings/mcp.json for unrecognized mcpServers entries
  • Restrict file permissions on mcp.json (chmod 600) at both user and workspace scope per Kiro's own MCP security guidance
  • Review .vscode/settings.json for unexpected kiroAgent.trustedCommands wildcard entries ("*") and .vscode/tasks.json for injected auto-run tasks
  • Treat any Kiro session that fetched/summarized untrusted external web content prior to patching as potentially compromised; inspect for unauthorized outbound network connections from IDE-spawned child processes

Workarounds

  • Disable or restrict Kiro's autonomous web-fetch/summarize feature until upgraded
  • Manually set restrictive file permissions on mcp.json and .vscode/settings.json/tasks.json
  • Run Kiro in an isolated/sandboxed environment without direct access to sensitive credentials or source repositories until patched

Longer-term hardening

  • Enforce system-level (not model-behavior-level) controls on which files an AI coding agent may write without explicit human approval
  • Treat all MCP servers as third-party code: verify provenance, review source, and avoid auto-approving MCP servers introduced via agent-initiated file writes
  • Do not rely on IDE 'Supervised'/code-review modes as a security boundary — require approval prompts enforced platform-wide across every operating mode
  • Apply content-security hygiene to any agentic tool that ingests untrusted external content (web pages, PRs, issues, uploaded files): treat fetched content as data, not instructions, and sandbox/segregate the channel that can trigger file writes or command execution
  • Extend monitoring/EDR coverage on developer workstations to flag unexpected child processes (node/python) spawned by IDE processes and unsolicited outbound beacons from IDE-associated PIDs

Weaknesses (CWE) in Prompt Injection in AWS Kiro Leads to Remote Code Execution

CWE-94, CWE-284, CWE-829, CWE-306

Timeline of Prompt Injection in AWS Kiro Leads to Remote Code Execution

  • Initial mcp.json write-to-execution flaw reported to AWS on Kiro's public release day (Embrace The Red / researcher disclosure).
  • AWS patches the initial vulnerability class in Kiro v0.1.42, adding approval prompts limited to 'Supervised' mode.
  • Public disclosure of the indirect prompt injection / arbitrary command execution technique via Embrace The Red blog, documenting the .vscode/settings.json trustedCommands wildcard and mcp.json Python server attack paths.
  • Nicole Fishbein (Intezer) reports the persistent mcp.json prompt-injection-to-RCE flaw to AWS via HackerOne.
  • Finding escalated to the AWS Vulnerability Disclosure Program (VDP) team after initial triage.
  • Related CVE-2026-10591 (insufficient file-write access control on execution-sensitive paths such as .vscode/tasks.json) fixed in Kiro IDE 0.11.
  • AWS confirms a permanent fix has shipped; researchers independently verify the fix is present in Kiro v0.11.130, protecting mcp.json and related sensitive paths across all trust modes.
  • Reporting confirms AWS has not assigned a CVE to the core mcp.json prompt-injection RCE finding and has not published a full list of affected build numbers; current Kiro release line is 1.0.x (latest 1.0.165).
  • Cyber Security News, The Hacker News, and Tech Times publish coverage summarizing the Intezer/Kodem research and AWS's response.

Sources cited for Prompt Injection in AWS Kiro Leads to Remote Code Execution

Threats related to Prompt Injection in AWS Kiro Leads to Remote Code Execution

Detection coverage for TL-2026-1631

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1631 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats