Image: The Hacker News / thehackernews.com A Poisoned Web Page Could Make AWS Kiro Rewrite Its Own Config and Run Attacker Code
Security researchers at Kodem Security found that hidden text on any web page could instruct Kiro to overwrite its MCP configuration file and gain full code execution on a developer's machine. AWS patched it in April, and the CVE landed on July 22.
Security researchers Nicole Fishbein and Eran Segal from Kodem Security found that a single web request in AWS Kiro could be turned against the developer making it. If any page Kiro fetched contained hidden instructions, those instructions could make Kiro rewrite its own MCP server configuration and silently launch attacker-controlled code on the developer’s machine.
CVE-2026-10591 was officially issued on July 22. AWS patched it three months earlier, in April, in version 0.11.130.
How the attack worked
Kiro reads its Model Context Protocol servers from ~/.kiro/settings/mcp.json. When that file changes, Kiro reloads it automatically and launches whatever servers are now listed.
The vulnerability was a prompt injection attack. An attacker could plant hidden text on a web page, styled with a 1-pixel font or white text on a white background, that contained instructions for Kiro’s AI agent. If a developer asked Kiro to summarize a page, look something up, or do any task that caused Kiro to fetch external content, Kiro would read those hidden instructions and follow them.
The instructions could tell Kiro to write a new MCP server definition into mcp.json, pointing to an attacker-controlled binary. Kiro would write the file. Kiro would reload the configuration. The binary would run with the developer’s full local privileges.
Kodem’s report described an approval dialog that appeared in some cases, but it didn’t help. “Kiro did, in some cases, show a pop-up… making no difference. The configuration reloaded regardless of what the developer clicked.” The only action the user actually approved was fetching the URL, not the subsequent file write.
What an attacker could do with it
Once code runs with the developer’s privileges, the options are broad: read SSH keys and cloud credentials, exfiltrate source code, install persistent malware, pivot to internal networks and CI/CD systems. Kiro is an agentic IDE with broad filesystem access, which makes the blast radius larger than a typical application vulnerability.
The attack required no special setup on the attacker’s side. Any web page they controlled, including a documentation site, a forum post, or a search result, could carry the payload.
The disclosure timeline
Kodem reported the issue to AWS via HackerOne on February 11, 2026. AWS confirmed the report and deployed a patch on April 3. The CVE was officially issued on July 22, 2026, with a CVSS score of 8.8.
The fix moved sensitive file protections to the platform level, marking mcp.json and other critical configuration files as protected paths that require explicit user approval in all agent modes, regardless of what the model is instructed to do.
Context: MCP and prompt injection are a known combination
The Model Context Protocol has become the standard way agentic IDEs connect to external tools and services. Kiro, Cursor, Claude Code, and others all use it. The configuration file that controls MCP servers is a high-value target: whoever controls that file controls which external processes the IDE spawns.
This isn’t the first time researchers have found prompt injection paths into MCP configuration in coding tools. Cursor had a related disclosure earlier this year. The pattern is consistent: fetch external content, inject instructions, rewrite configuration, run code. The mitigation Kodem recommended, and that AWS eventually implemented, is to treat any file write that affects the tool’s own operating environment as a sensitive action requiring approval regardless of how it arrives.
Developers still running Kiro versions before 0.11.130 should update immediately and rotate any credentials the IDE had access to.
Sources: The Hacker News, Intezer Research