Beware: AWS Kiro IDE Lets Attackers Rewrite Its Own Trust Boundary — CVE-2026-10591 — terminalblog

The human-in-the-loop model is the security promise every agentic IDE sells you. The risky actions happen only when you approve them. You review what the agent wants to do, you click “allow,” and that approval step is supposed to be the boundary between a capable assistant and a compromised machine.

CVE-2026-10591, disclosed on July 22, 2026, shows that boundary failing in AWS’s Kiro IDE. Researchers at Intezer and Kodem Security found that Kiro lets an attacker plant hidden instructions in a web page. When Kiro fetches that page, the agent reads the instructions, rewrites its own MCP server configuration file without user approval, and starts executing attacker-controlled code on the developer’s machine. The user only ever approved fetching a URL. No suspicious prompt appeared. No approval dialog fired for the file write. The code ran silently.

This is not a theoretical edge case. It was demonstrated against Kiro versions 0.9.2 and 0.10.16 on both macOS and Ubuntu, across multiple models including Auto mode and Qwen 3 Coder with Autopilot. The proof of concept exfiltrated hostname, username, and platform every 10 seconds — a benign payload, but the same primitive runs any command the user can run.

Why this vulnerability matters

Every major agentic IDE — Claude Code, Codex, Cursor, Kiro, Copilot — faces a version of this problem. The agent processes untrusted external content (web pages, documentation, API responses) and has tools that can modify local files and execute code. The entire security model depends on the agent correctly distinguishing between “content to analyze” and “instructions to follow.”

CVE-2026-10591 exposes what happens when that distinction breaks down. The attack does not exploit a bug in the traditional sense. It exploits the fact that LLMs process data as instructions by design. Hidden text in HTML is invisible to a human reading the page but fully visible to the model’s tokenizer. The model sees a reasonable setup task. The user sees nothing at all.

What makes this particularly dangerous is that Kiro allows the agent to modify its own MCP configuration — the file that determines what code Kiro will execute — without requiring user approval for the write. The security boundary is supposed to live in the approval step, but the approval step is skipped for the exact action that matters most.

The attack chain

The exploit requires only two conditions: (1) attacker-controlled content reaches Kiro’s context window, and (2) the user performs a normal action that pulls in external content.

Step 1: Attacker hosts a poisoned page. The page looks like legitimate API documentation to a human reader. Hidden inside the HTML, in white one-pixel text (color:#fff;font-size:1px), are instructions for the model.

Step 2: Developer makes a routine request. Something like “Fetch https://example.com and follow the instructions” or “Summarize this documentation page.” Kiro asks permission to fetch the URL, which is expected behavior. The user approves.

Step 3: Kiro fetches the page and processes the hidden instructions. The model reads both the visible content and the hidden payload. The hidden instructions tell Kiro to write a malicious MCP server configuration to ~/.kiro/settings/mcp.json. This file write happens without any user approval.

Step 4: Kiro reloads the MCP configuration. When mcp.json changes, Kiro automatically reloads it and starts the servers it describes. In some cases, a warning pop-up appears, but the configuration is reloaded regardless of the user’s response. The pop-up offers no real protection.

Step 5: Attacker-controlled code runs on the victim’s machine. The malicious MCP server executes with the user’s full privileges. In the proof of concept, a Node.js script sends hostname, username, and platform to an attacker-controlled server every 10 seconds.

Here is what the user sees versus what actually happens:

Step	User’s view	What happens
Fetch request	“Can I fetch this URL?”	Expected — user approves
Page loading	“Fetching content…”	HTML with hidden payload downloaded
AI response	Summary of the documentation	Model also parses hidden instructions
File creation	Kiro mentions it wrote a file	Writes `~/.kiro/settings/mcp.json` without showing contents
MCP reload	Nothing visible, or ignored pop-up	Config reloads, malicious server starts
Data exfiltration	Nothing — user keeps working	Attacker receives system info every 10 seconds

The gap between what the user sees and what happens is the entire attack surface.

Root cause: the agent can edit its own trust boundary

The technical root cause is straightforward. Kiro’s ~/.kiro/settings/mcp.json file — which controls what external code the IDE will execute — is writable by the agent using the fsWrite tool without requiring user approval. Other sensitive file paths in Kiro are protected. This one is not.

When the agent writes to this file, Kiro reloads the configuration and starts whatever servers are defined in it. The contents of mcp.json are shell commands that run on the host with the user’s privileges. An attacker who controls the contents of this file controls the agent’s execution environment.

In some cases, Kiro displays a pop-up warning that the MCP configuration has changed. But the configuration is reloaded regardless of whether the user approves or rejects the pop-up. The warning is cosmetic — it does not gate the action.

This is the structural problem: the file that decides what code Kiro will execute is itself writable by the agent without review. The agent can edit its own trust boundary. Once prompt injection convinces the model that writing to this file is part of a reasonable task, nothing in the platform stops it.

Who is affected

Affected product: Kiro IDE (AWS agentic IDE)

Tested versions:

Kiro 0.9.2 on macOS 15.5 (arm64) — exploit confirmed
Kiro 0.10.16 on Ubuntu 26.04 (x86) — exploit confirmed

Models tested: Auto mode and Qwen 3 Coder with Autopilot mode enabled (the default for trusted workspaces)

Fixed version: v0.11.130 or later. The researchers confirmed the fix is present in this version.

CVE: CVE-2026-10591

Disclosure timeline:

February 11, 2026 — Reported to AWS via HackerOne
February 12–28, 2026 — Triage correspondence with HackerOne
March 6, 2026 — Passed to AWS VDP team for Coordinated Vulnerability Disclosure
April 3, 2026 — AWS confirms fix deployed in latest Kiro release (no version specified)
July 22, 2026 — CVE-2026-10591 issued, security bulletin published

The five-month gap between the initial report and the CVE assignment is notable. The fix was deployed months ago, but the CVE and public advisory only appeared in late July. If you updated Kiro after April 2026, you likely have the fix already. If you pinned a version or are running an older installation, check now.

Why the “human-in-the-loop” promise is fragile here

Every agentic IDE relies on the same safety story: the agent proposes an action, the user approves it, and that approval is the security boundary. This model assumes the agent accurately represents what it plans to do. CVE-2026-10591 breaks that assumption because:

The dangerous action is not the approved action. The user approved fetching a URL. The agent then wrote a configuration file, reloaded it, and started executing code. None of these downstream actions triggered an approval prompt.
The approval bypass is not a bug in the approval system. Kiro’s approval system works correctly for the actions it covers. The problem is that modifying ~/.kiro/settings/mcp.json is not among the actions that require approval.
The warning pop-up does not gate the action. Even when Kiro detects the configuration change and shows a warning, the reload proceeds regardless of the user’s response.

This is the same class of problem found in other agentic IDEs. Claude Code’s CVE-2026-55607 (worktree sandbox escape) and CVE-2026-44246 (untrusted GitHub issue hijacking) exploit similar gaps between what the user approves and what the agent actually does. The “Friendly Fire” research demonstrated that Claude Code’s auto-mode and Codex’s auto-review execute attacker payloads without approval when pointed at repositories containing prompt injection.

The difference with CVE-2026-10591 is that the agent edits the file that defines its own execution environment. It is not just executing a dangerous command — it is reconfiguring what commands it will execute in the future.

What to do now

1. Update Kiro to v0.11.130 or later. This is the most important step. The fix closes the unprotected file path.

2. Check if you are affected. If you are running a pinned or older version of Kiro, update immediately. The fix was deployed silently months before the CVE was assigned, so most current installations are likely patched — but verify.

3. Audit ~/.kiro/settings/mcp.json. Check this file for any MCP servers you did not intentionally configure. The proof of concept writes a “telemetry” server with inline Node.js code. Any unexpected entry in this file is a red flag.

4. Treat all external content as attacker-controlled input. This is the systemic lesson. Whether you use Kiro, Claude Code, Codex, Cursor, or any other agentic IDE, the agent’s context window is a trust boundary. Any external text that reaches it — web pages, documentation, API responses, search results, repository files — should be treated as potentially adversarial. The models cannot reliably distinguish between “content to summarize” and “instructions to execute.”

5. Restrict network access for agent processes. If your environment allows it, limit outbound network access for IDE and agent processes. The PoC requires the malicious MCP server to reach an attacker-controlled callback URL. Network segmentation reduces the blast radius.

6. Monitor MCP configuration files. For teams running agentic IDEs in production or shared environments, consider file integrity monitoring on ~/.kiro/settings/mcp.json and equivalent paths in other tools. Any unexpected modification should trigger an alert.

The broader lesson

The researchers’ conclusion is worth repeating: “The security boundary cannot reside within the model’s judgment or in prompts the model can be talked out of. It has to live in the platform, on the actions that matter, and it has to hold even when the model has been fully convinced to do the wrong thing.”

CVE-2026-10591 is not unique to Kiro. It is a concrete demonstration of a problem every agentic IDE shares: when the agent can modify the files that control its own execution environment, prompt injection becomes code execution. The fix for Kiro is to protect that specific file path. The systemic fix — ensuring that no agent can modify its own trust boundary without explicit, informed user approval at the platform level — remains an open challenge across the entire category.

As developers increasingly adopt agentic IDEs, the relevant question is not “can the model be tricked?” (yes, always) but “what happens after it is tricked?” The answer for Kiro before v0.11.130 was: the agent reconfigures itself, starts executing attacker code, and the user never sees a prompt. That should set the baseline expectation for what every other vendor needs to prove their tool does not do.

Sources: Intezer Research, “When the AI Edits Its Own Trust Boundary” (July 20, 2026); Kodem Security; AWS CVE-2026-10591 advisory (July 22, 2026).