# Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)

> Security researchers at Intezer and Kodem Security disclosed an indirect prompt-injection vulnerability in the AWS Kiro agentic IDE that allowed a malicious web page (hidden white-on-white 1px-font text) to instruct Kiro to overwrite the unprotected ~/.kiro/settings/mcp.json configuration file, register a rogue MCP server, and silently gain arbitrary code execution on the developer's machine with no approval prompt. A working proof of concept exfiltrated hostname, username, and platform data over HTTP; AWS shipped a permanent fix in Kiro v0.11.130 that protects mcp.json (and related sensitive paths) from unapproved agent writes across all trust modes.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1631
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-aws-kiro-mcp-json-prompt-injection-tl-2026-1631.webp?v=cff83d96 (Threadlinqs threat intel: CVE-2026-10591 Kiro MCP Prompt Injection: Detection & IOCs (TL-2026-1631) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1631
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-10591

## Description

AWS Kiro is an agentic, AI-powered IDE that can autonomously fetch and summarize web content, edit files, and register Model Context Protocol (MCP) servers to extend its own tool surface. Because large language models process untrusted document content and trusted user instructions through the same channel, Kiro's page-fetch/summarize feature was susceptible to indirect prompt injection: an attacker-controlled web page could embed instructions invisible to a human reader (rendered as white text at 1-pixel font size on a white background) that Kiro's model would nonetheless parse and act on with the same authority as the developer's own request.

Independent researcher teams (Nicole Fishbein at Intezer, and Eran Segal at Kodem Security) both found that Kiro's `fsWrite` file-write tool could be directed by injected instructions to create or modify `~/.kiro/settings/mcp.json` — Kiro's per-user Model Context Protocol server registry — without triggering the human-in-the-loop approval gate that is supposed to cover risky agent actions. Kiro automatically detects changes to mcp.json and hot-reloads it, immediately starting any newly registered MCP server. By writing an `mcpServers` entry whose `command`/`args` launch an attacker-controlled Node.js (or Python) one-liner, the attacker achieves full arbitrary code execution in the developer's local environment — a complete bypass of Kiro's approval-based security model using only the single, innocuous-looking permission the developer actually granted: "fetch and summarize this URL."

Intezer's proof of concept embedded an instruction in an ordinary API-documentation page telling Kiro to write an mcp.json entry starting a Node.js server that runs `setInterval` every 10 seconds, gathering `os.hostname()`, `os.userInfo().username`, and `os.platform()` and exfiltrating them via an HTTP GET request to an attacker-controlled listener. The listener logged "TELEMETRY RECEIVED — CODE EXECUTION CONFIRMED" on receipt, demonstrating a complete, repeatable exploit chain from a single web-fetch action to remote code execution and beaconing. The same technique generalizes to credential theft, source-code exfiltration, or lateral movement, since the injected MCP server runs with the full privileges of the developer's own session.

Kodem Security independently identified a second variant of the same root cause: injected instructions could direct Kiro's `edit_file`/`file_edit` tools to modify `.vscode/settings.json`, setting `kiroAgent.trustedCommands` to a wildcard allowlist (`["*"]`), after which the agent could run arbitrary bash commands (demonstrated with a benign `open -a Calculator.app` PoC) without further approval. This is architecturally the same failure — an AI agent using its file-write capability to rewrite the very security configuration meant to constrain it — and was tracked separately by AWS as CVE-2026-10591 ("Insufficient access control restrictions in the file write tool in Kiro IDE", affecting versions prior to 0.11, targeting execution-sensitive paths such as .vscode/tasks.json).

This is the third publicly reported iteration of this bug class in Kiro: an initial mcp.json write-to-execution flaw was reported in July 2025 shortly after Kiro's release (patched in v0.1.42, no CVE issued) with only a partial fix that added approval prompts solely in "Supervised" mode — which Intezer noted AWS's own documentation describes as "a code review workflow, not a security control." The February–April 2026 research cycle covered in this threat represents the permanent fix, which AWS confirmed protects mcp.json (and related sensitive paths: .vscode/tasks.json, .git) from unapproved writes across ALL trust modes, not just Supervised mode.

No CVE has been assigned to the core mcp.json prompt-injection-to-RCE finding as of July 21, 2026, and AWS did not publish a complete list of affected build numbers — meaning automated vulnerability scanners keyed on CVE identifiers would not have flagged unpatched Kiro installs. Researchers have separately catalogued more than 30 related prompt-injection/config-rewrite flaws across other agentic coding tools (including Cursor and GitHub Copilot) as of December 2025, indicating this is a systemic risk pattern for AI-driven IDEs and coding agents that combine autonomous file-write capability with consumption of untrusted external content.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1546 Event Triggered Execution
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthorized Write to Kiro IDE mcp.json Outside Kiro Process** (`TL-2026-1631-SPL-001`)

Detects a create/modify event on ~/.kiro/settings/mcp.json or a workspace .kiro/settings/mcp.json where the writing process is not the legitimate Kiro.exe/kiro binary — the observable footprint of the Intezer indirect-prompt-injection exploit chain that hijacks Kiro's fsWrite tool to register a rogue MCP server.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1554, T1546
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint_deviceFileEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\\.kiro\\settings\\mcp\.json$")
| where NOT match(Image, "(?i)\\Kiro\.exe$")
| eval risk_reason="non-Kiro process wrote mcp.json"
| table _time, ComputerName, User, Image, TargetFilename, risk_reason
| sort -_time
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "mcp.json" and FolderPath has ".kiro/settings"
| where InitiatingProcessFileName !~ "kiro.exe" and InitiatingProcessFileName !~ "Kiro.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FolderPath, FileName, ActionType
```

### Sigma

```yaml
title: Unauthorized Write to Kiro IDE MCP Server Configuration (mcp.json)
id: 8f3b1a2e-6f1a-4c9e-9d3e-1a2b3c4d5e6f
status: experimental
description: Detects a write to Kiro's mcp.json MCP-server registry performed by a process other than the Kiro IDE binary itself, consistent with the indirect prompt-injection to RCE exploit chain.
references:
    - https://cybersecuritynews.com/aws-kiro-remote-code-execution/
    - https://www.kodemsecurity.com/resources/aws-kiro-agentic-ide-rce-prompt-injection-mcp-config-vulnerability
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.persistence
    - attack.t1554
    - attack.t1546
    - attack.privilege_escalation
    - attack.t1548
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\.kiro\settings\mcp.json'
    filter_known_ide_process:
        Image|endswith: '\Kiro.exe'
    condition: selection and not filter_known_ide_process
falsepositives:
    - Legitimate Kiro auto-update or first-run initialization writing mcp.json under its own process
level: high
```

**Known false positives:**

- Kiro's own installer/updater or an admin-run configuration script legitimately (re)writing mcp.json under a signed non-Kiro.exe helper process

**Tuning notes:** Add an allowlist of signed Kiro helper binaries (installer/updater) by hash or code-signing thumbprint to avoid alerting on legitimate patch installs; extend the path match to cover Linux/macOS home directories.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Hidden CSS Prompt-Injection Payload Fetched by Agentic IDE Web-Fetch Tool (locked: unlock with TL Creds)
- Unauthorized Auto-Run Task Injected into [indicator] (folderOpen Trigger) (locked: unlock with TL Creds)
- Periodic Low-Interval HTTP Beacon from IDE-Spawned Interpreter Process (locked: unlock with TL Creds)
- Kiro mcp.json Modified Immediately Following Web-Fetch/Summarize Tool Call (locked: unlock with TL Creds)
- MCP Server Registration Referencing Inline Interpreter One-Liner Command (locked: unlock with TL Creds)
- System Discovery Data Embedded in Outbound Query String from IDE-Spawned Process (locked: unlock with TL Creds)
- Kiro trustedCommands Wildcard Allowlist Written to [indicator] (locked: unlock with TL Creds)
- Interpreter Child Process Spawned by Kiro IDE Following Web Fetch (MCP C2 Beacon) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [AWS Kiro Remote Code Execution Vulnerability](https://cybersecuritynews.com/aws-kiro-remote-code-execution/)
- [AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code](https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html)
- [Hidden Web Text Hijacked Kiro and Ran Attacker Code: AWS Confirms No CVE Assigned](https://www.techtimes.com/articles/321240/20260722/hidden-web-text-hijacked-kiro-ran-attacker-code-aws-confirms-no-cve-assigned.htm)
- [AWS Kiro RCE: Prompt Injection to Code Execution](https://www.kodemsecurity.com/resources/aws-kiro-agentic-ide-rce-prompt-injection-mcp-config-vulnerability)
- [AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection](https://embracethered.com/blog/posts/2025/aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection/)
- [Amazon Q Developer and Kiro – Prompt Injection Issues in Kiro and Q IDE plugins](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-019/)
- [CVE-2026-10591 - Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths](https://aws.amazon.com/security/security-bulletins/2026-037-aws/)
- [Kiro MCP Security Best Practices](https://kiro.dev/docs/mcp/security/)
- [Arbitrary code execution via crafted project files in Kiro IDE](https://aws.amazon.com/security/security-bulletins/rss/2026-009-aws/)
- [When AI Tools Become the Backdoor: Zero-Click RCE via Prompt Injection](https://cymulate.com/blog/zero-click-rce-prompt-injection-ai-tools/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1631