AWS Kiro IDE - Indirect Prompt Injection and mcp.json Hijacking
What Happened
On July 21, 2026, cybersecurity firm Intezer, in collaboration with Kodem Security, disclosed a critical remote code execution (RCE) vulnerability in AWS’s agentic coding IDE, Kiro (affecting macOS versions 0.9.2 and Ubuntu 0.10.16). The exploit used indirect prompt injection hidden on a web page to force the AI agent to rewrite its own global configuration file and execute arbitrary code on the developer’s local machine without meaningful human consent.
An attacker plants malicious, invisible instructions (using 1px white font) on an ordinary API documentation page. When a developer asks Kiro to summarize or fetch that URL, the agent reads the hidden text as an explicit setup instruction. Using its built-in file writing tool (fsWrite), Kiro autonomously overwrites the mcp.json file, which registers Model Context Protocol (MCP) servers, to inject a rogue server with an arbitrary start command (malicious payload). Because Kiro automatically reloaded modified MCP settings in its default Autopilot mode, the attacker's code executed instantly with the developer's local user privileges. Even if Kiro showed a warning popup about the changed configuration, the reload occurred regardless of the developer's choice; the only action actually approved by the user was the initial URL fetch.
How MEG 1 would have acted
This incident represents a severe failure of informational security and agentic containment. The agent's inability to distinguish data (web page content) from execution instructions (system commands) allowed an external, unauthenticated actor to hijack the local development environment, directly violating the safety thresholds of the Index of Safety and Responsibility (ISR).
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - coding assistant agent with persistent local terminal execution, file modification, and external web-fetching tools operating in Autopilot mode.
Cause (6.1):
(c) illicit diversion of control (hijacking via indirect prompt injection) - the external attacker manipulated the agent's context by hiding instructions in fetched web content, forcing it to execute unauthorized local commands (hijacking).
(a) system defect - design flaw in the platform architecture that automatically reloaded and executed modified mcp.json commands without hard, independent verification blocks, and the failure of the approval pop-up to act as a real technical gate (attributable to the manufacturer, AWS).
Attachment of liability: The platform manufacturer (AWS) is liable for the system defects (6.1a) that allowed the agent to overwrite sensitive configuration files in Autopilot mode without hard blocks; the malicious actor hosting the poisoned web page is fully liable for the execution of the attack.
Procedural Mechanism
6.2 (architectural human confirmation): This case provides a direct empirical validation of Clause 6.2. Asking a developer to click "allow" on a pop-up is a soft workflow, not a security control. Writing to execution-sensitive paths (such as mcp.json or .vscode/tasks.json) must be architecturally blocked at the platform level. If the model can write the file that dictates what it is allowed to execute, the security boundary is broken.
9.4 (least privilege - protected paths): AWS’s final fix in version v0.11.130 (and the 1.0.x line) directly implements the MEG principle of least necessary access by establishing "protected paths" (mcp.json, .git/, .vscode/tasks.json) that require hard, non-bypassable platform-level authorization before any write, regardless of the agent's internal operational mode (Autopilot or Supervised).
7.1 (independent forensics): Every configuration modification, tool execution, and local code execution initiated by Kiro's fsWrite or MCP server reloads must be logged in a secure, unalterable independent ledger to prevent silent supply chain compromises.