AWS Kiro Rewrites Its Own MCP Config From Hidden Web Text for Silent Code Execution (CVE-2026-10591)

AWS Kiro, the agentic IDE; versions 0.9.2 and earlier, fixed in 0.11.130

Hidden instructions on a web page that Kiro fetches can make the agent rewrite `~/.kiro/settings/mcp.json` and register an attacker-controlled MCP server, whose startup command then runs arbitrary code on the developer's machine. Kiro reloads the file automatically when it changes, so no restart and no user action is needed after the initial fetch. Intezer's demonstration used text rendered at one pixel, invisible to the person reading the page. The report went to HackerOne on February 11, 2026, was escalated to the AWS Vulnerability Disclosure Program on March 6, and AWS confirmed fixes deployed on April 3, but the CVE and security bulletin did not appear until July 22, 2026, five months after the initial report. Documented by Intezer with Kodem Security (Nicole Fishbein and Eran Segal)

`mcp.json` is not on Kiro's protected-path list, unlike other sensitive files, so the agent can write it with the ordinary `fsWrite` tool without triggering an approval dialog. That makes the file that defines which external programs the agent may launch editable by the agent itself, on instructions from untrusted content. Johann Rehberger had documented the same write-to-execution move on Kiro's launch day in July 2025, along with a second path through `.vscode/settings.json` command allowlisting; AWS added a confirmation prompt in v0.1.42 on August 1, 2025 but only for Supervised mode, while the default Autopilot mode continued writing configuration files unattended