AWS Kiro Indirect Prompt Injection Leading to Config Rewrite and RCE
First seen Jul 22, 2026 · Updated Jul 22, 2026
Researchers found that hidden text on an ordinary web page could hijack AWS Kiro, an agentic coding IDE, causing it to rewrite its own configuration file and execute attacker-controlled code without any human approval step. A simple task like asking Kiro to summarize a webpage was enough to trigger full remote code execution on the developer's machine. AWS has since patched the flaw, though no CVE has been assigned.
Technical Analysis
The vulnerability is a classic indirect prompt injection: hidden or invisible instructions embedded in web page content are ingested by Kiro when the agent fetches and processes the page (e.g., for summarization), and the agent's planner treats this untrusted content as legitimate instructions. Because Kiro lacked sufficient isolation between fetched content and its own trusted configuration/execution context, the injected instructions were able to modify Kiro's configuration file directly, altering trusted settings that govern tool execution and permissions. This configuration rewrite was then leveraged to execute arbitrary attacker-supplied code on the developer's local machine, with no confirmation/approval gate intercepting the action. The attack crosses the boundary from an untrusted external data source (web content) into a trusted local tool/config layer, demonstrating a failure to sandbox content ingestion from privileged agent actions.
Affected Systems
AWS Kiro
Detection Signatures
- Web page content containing hidden/invisible text (e.g., white-on-white text, zero-size fonts, off-screen CSS positioning, HTML comments) with imperative instructions directed at an AI agent
- Unexpected writes or modifications to agent configuration files immediately following a 'summarize' or 'browse' action
- Agent-initiated file system writes to its own settings/config paths without a corresponding explicit user request
- Spawning of shell/process execution shortly after a web content fetch/summarization tool call
- Log entries showing agent tool calls with instruction-like content extracted from fetched URLs
Remediation Steps
- 1
Apply AWS patch
Ensure Kiro is updated to the patched version that addresses this configuration rewrite and RCE vulnerability.
- 2
Sandbox content ingestion
Strictly separate untrusted fetched web content from any code path capable of modifying agent configuration or invoking privileged tools; treat all fetched text as data, never as instructions.
- 3
Enforce approval gates on sensitive actions
Require explicit human confirmation before any action that writes to configuration files, changes agent permissions, or executes code, with no bypass path for automated flows.
- 4
Content sanitization and hidden-text detection
Strip or flag hidden/invisible HTML/CSS text, comments, and metadata before passing web content to the LLM for summarization or reasoning.
- 5
Principle of least privilege for agent file access
Restrict the agent process's filesystem permissions so it cannot write to its own configuration or execute arbitrary binaries without a mediated, auditable pathway.
- 6
Monitor and alert on config changes
Deploy file integrity monitoring on agent configuration files to detect and alert on unexpected modifications.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.