Poisoned web page could rewrite AWS Kiro's config file and run code

Researchers at Intezer showed that a poisoned web page could take over AWS Kiro, an AI coding tool, by getting the agent to rewrite the file that governs what it is allowed to run. A prompt injection in fetched content drops custom code into the MCP settings file, which executes the moment the file is saved. The same write to execution path was demonstrated on Kiro's release day in July 2025 by another researcher, who also flagged writing to a Visual Studio Code settings file to allowlist shell commands. AWS added an approval prompt, but only in supervised mode, leaving the default autonomous mode writing the file unprompted.

Check

If you use AWS Kiro or similar agentic coding tools, check which mode they run by default and whether the agent can write its own MCP or editor configuration files without approval.

Affected

Developers running AWS Kiro in its default autonomous mode; content fetched from a web page can inject instructions that rewrite the agent's MCP settings file, and saving that file executes attacker-supplied code.

Fix

Require approval for agent writes to configuration files in every mode, keep those files outside what the agent can modify, and treat fetched web content as untrusted rather than trusting mode settings.