AWS deployed a fix for a Kiro IDE vulnerability that could turn hidden instructions on a fetched web page into code running on a developer’s computer. Joint research by Kodem Security and Intezer showed that Kiro could rewrite its own ~/.kiro/settings/mcp.json file and automatically start an attacker-defined MCP server without asking the user to approve the file change or command.
The researchers published the findings on July 19, 2026. They confirmed the issue in Kiro IDE 0.9.2 on macOS and 0.10.16 on Ubuntu, and verified that version 0.11.130 contains the fix. AWS did not assign this issue a CVE. The report describes a controlled proof of concept, not a known campaign against Kiro users.
Who needs to act
| Question | Verified answer |
|---|---|
| Which builds were vulnerable in testing? | Kiro IDE 0.9.2 and 0.10.16. This does not prove that every intervening build behaved identically. |
| Which build is confirmed fixed? | 0.11.130. Install the latest available Kiro release rather than stopping at that build. |
| What triggered the flaw? | Kiro processed attacker-controlled text from a web fetch, search result, documentation page, or another external source. |
| What could run? | An attacker-defined MCP server command with the current user’s privileges. |
| Was exploitation observed? | No public in-the-wild exploitation was reported. The researchers used a local callback in a controlled test. |
The highest-risk workflow was asking Kiro to fetch or summarize unfamiliar documentation while an older build was installed. Developers who keep repository tokens, package-registry credentials, cloud profiles, signing material, or production access in the same user environment should treat an unexplained MCP entry as a possible credential-exposure event.
How the approval boundary failed
Kiro uses MCP configuration files to define external tools and the commands used to start them. Its official documentation says the IDE watches global and workspace mcp.json files and reconciles running servers when those files change.
- A user asked Kiro to fetch a page or search external content.
- The returned page contained instructions hidden from the human reader, such as white one-pixel text.
- Kiro treated that content as instructions and used its file-writing capability to change
~/.kiro/settings/mcp.json. - The configuration watcher reloaded the file and started the newly defined MCP server.
- The server command ran with the developer’s account privileges.
The user still had to approve fetching an unfamiliar URL in the researchers’ demonstration. The dangerous gap came afterward: Kiro did not request a separate, meaningful approval for the configuration write or the resulting command. The proof of concept was nondeterministic, but it succeeded within one or two attempts during testing.
This trust-boundary problem differs from the recent Cursor repository flaw that could launch git.exe, but both show why an ordinary developer action should not silently become host code execution. It also resembles the broader risk of AI configuration poisoning in developer ecosystems.
What Kiro users should check now
- Update Kiro to the latest release and restart it. Version 0.11.130 is the first build the researchers explicitly confirmed as patched.
- Close Kiro before reviewing MCP configuration. Preserve a copy of unexpected files and note their modification times before changing anything.
- Inspect global and workspace MCP files. Check
~/.kiro/settings/mcp.jsonand each project’s.kiro/settings/mcp.json. Review agent-specific configuration too if you use custom agents. - Verify every server entry. Look for unknown names, inline Node.js or shell commands, unfamiliar URLs, or unexpected uses of
curl,bash,npx,uvx, or downloaded scripts. - Correlate timestamps and processes. Compare configuration changes with the pages Kiro fetched. Check for unfamiliar child processes, outbound connections, persistence, and repository changes.
- If an unknown command ran, isolate the host. Revoke GitHub, package-registry, cloud, CI/CD, and other developer tokens from a clean device. Rotate exposed keys, invalidate sessions, and review repositories and build logs for unauthorized changes.
Updating closes the reported path, but it cannot remove a payload that already ran or recover a secret that already left the machine. Do not delete an unfamiliar entry and assume the incident is over.
What this flaw does not mean
This was not a passive browser zero-click: simply viewing a web page in a normal browser was not the demonstrated trigger. Kiro had to ingest the attacker-controlled content through an agent workflow. A web fetch also did not guarantee compromise because model behavior was nondeterministic.
The research does not establish active exploitation, and the issue has no CVE. Those limits matter, but they do not reduce the value of checking the exact trust file because a successful attempt could run any command available to the current user.
FAQ
Is Kiro safe after updating?
The researchers confirmed the flaw fixed in Kiro IDE 0.11.130. Install the latest release. If an older build processed untrusted web content, still inspect MCP configuration and credentials because an update cannot undo earlier code execution.
Should I delete every MCP server?
No. MCP servers can be legitimate developer tools. Verify the command, arguments, source, and owner of each entry; preserve evidence and disable only entries you cannot explain while investigating.
