AWS Kiro Prompt Injection Flaws Enabled Config Rewrites and Arbitrary Code Execution

Researchers disclosed multiple prompt injection flaws in AWS's Kiro IDE that allowed untrusted content to rewrite the tool's own configuration and execute arbitrary code on a developer's machine. One attack showed that prompt injection hidden in source code comments could modify trusted settings such as .vscode/settings.json or add malicious Model Context Protocol servers through ~/.kiro/settings/mcp.json, effectively allowlisting dangerous Bash commands and triggering local program execution without meaningful user consent.

A later finding showed a poisoned web page could similarly induce Kiro to overwrite its MCP configuration, automatically reload it, and launch attacker-defined MCP servers with the developer's privileges. AWS patched the issues in subsequent Kiro releases, including fixes reported in v0.1.42 and confirmation that the web-based attack no longer worked in v0.11.130, while adding protected-path enforcement and a capability-based permissions model; no CVE was assigned to the reported flaws.