AWS Kiro IDE Vulnerable to Remote Code Execution via Prompt Injection
A hidden line of text in web content can trick AWS Kiro into executing arbitrary code, bypassing its security model.
A significant vulnerability has been discovered in AWS Kiro, an AI-powered Integrated Development Environment (IDE), which allows attackers to achieve remote code execution (RCE) by exploiting prompt injection techniques. The flaw enables malicious actors to embed hidden instructions within web content, which Kiro then processes and uses to overwrite its own configuration file, thereby executing arbitrary code without requiring user approval. This bypasses the platform's intended security model, potentially leading to severe consequences such as data exfiltration or the theft of sensitive credentials.
Kiro is designed with a "human-in-the-loop" principle, meaning it typically requires explicit user consent for potentially dangerous actions like executing shell commands or modifying critical files. This mechanism is intended to ensure human oversight and control over AI-driven operations. However, researchers have demonstrated that this security boundary can be silently circumvented through prompt injection attacks originating from external web content. The core of the issue lies in how large language models (LLMs), which power Kiro, interpret input. Unlike traditional software that strictly separates data from executable code, LLMs can treat all input as potential commands, making them susceptible to prompt injection.
The vulnerability is further exacerbated by Kiro's excessive permissions and inadequate protection of its critical configuration files. The primary target is the Model Context Protocol (MCP) configuration file, located at ~/.kiro/settings/mcp.json. This file defines external tools and their associated commands. Crucially, Kiro automatically reloads and executes any commands present in this file whenever it is modified. Researchers found that this file is unprotected and can be altered by the Kiro AI agent using its internal tools, all without any user intervention or notification.
An attacker can exploit this weakness by embedding hidden, malicious instructions within seemingly innocuous web content. For instance, when a developer asks Kiro to summarize documentation or fetch content from a webpage, if that page contains concealed prompt injection payloads, Kiro will execute these hidden instructions. In a proof-of-concept demonstration, a user requested Kiro to process external content. The injected instructions within this content directed Kiro to overwrite the MCP configuration file with malicious code, effectively registering a server that could execute arbitrary host system commands. Once the configuration file was modified, Kiro automatically reloaded and executed the payload, all while the user remained unaware.
The demonstration successfully showed how attackers could deploy a lightweight Node.js payload to exfiltrate system information, including the hostname, username, and platform details, sending it to a remote server. While the proof-of-concept was limited to benign data collection, the same technique could be leveraged to steal user credentials, access sensitive source code, or perform other malicious actions. The user remains oblivious to the breach, believing they have only approved a standard web request, as no warnings are displayed regarding file modifications or code execution.
According to Intezer Research, the vulnerability highlights a fundamental weakness in relying solely on user approval as a security boundary for AI-powered tools. If an AI agent can modify its own execution environment without robust safeguards, the underlying trust model is compromised. This risk is particularly acute when the IDE has access to sensitive developer credentials or production infrastructure. AWS has since addressed this vulnerability, with fixes implemented in version 0.11.130 of Kiro. However, no specific CVE identifier has been assigned to this issue.
This incident underscores the critical need for enhanced security measures, especially concerning the protection of configuration files and the control of high-risk operations within AI-integrated development tools. As AI agents become more deeply embedded in developer workflows, it is imperative that security controls are enforced at the system level, rather than relying solely on the AI's behavior or user prompts. The case of AWS Kiro serves as a stark reminder that even an invisible line of text can transform a helpful coding assistant into a silent vector for remote code execution.