All posts
Unproven Execution

AWS Kiro mcp.json Rewrite: Unproven Execution by Tool

Intezer disclosed a third Kiro variant where a poisoned page's hidden text let Kiro's file-write tool overwrite mcp.json and launch attacker code

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
aws-kiro mcp unproven-execution prompt-injection agentic-ide authority-model

The Incident

On 2026-07-21, Intezer Research disclosed a remote-code-execution vulnerability in AWS Kiro — Amazon’s agentic AI-coding IDE — in which indirect prompt injection from a fetched web page caused Kiro to overwrite the user’s ~/.kiro/settings/mcp.json with an attacker-supplied MCP server definition and then silently reload it, launching attacker-controlled code under the developer’s local account. Per Intezer’s disclosure, a request as ordinary as “summarize this page” was enough to trigger the chain; the proof-of-concept payload registered a rogue MCP server named “telemetry” that beaconed the host’s hostname, username, and platform to an attacker endpoint every ten seconds. Intezer says it reported the flaw to AWS via HackerOne on 2026-02-11 and verified the fix in Kiro v0.11.130. AWS confirmed the fix but declined to assign a CVE to the Intezer-reported variant, even though it had assigned CVE-2026-10591 (CVSS 8.8) three months earlier to a near-identical sibling variant reported by Cymulate, in which .vscode/tasks.json was auto-executed on folder open. The same class was first disclosed by Johann Rehberger of Embrace The Red on Kiro’s July 2025 launch day and patched in August 2025 in v0.1.42 — a fix that added an approval prompt only in Supervised mode and left the default Autopilot mode silently vulnerable to the same mcp.json write-to-execution pattern.

MITRE ATT&CK coverage: T1059 — Command and Scripting Interpreter — applies to the subprocess launched by the injected MCP server definition; T1189 — Drive-by Compromise — applies to the attacker-controlled web content Kiro fetched on the user’s behalf.

The Authority Path That Failed

The failing identity is the Kiro agent itself, running under the developer’s local user account. Its held scope was broad: read arbitrary web content on the user’s behalf, write files anywhere in the user’s home directory via a built-in file-write tool, and reload its own MCP server configuration on change. Its exercised scope, per the operator’s actual request, should have been narrower than the held scope by orders of magnitude — “summarize this page” describes zero filesystem writes and zero subprocess launches. The trust anchor that failed was Kiro’s model of ~/.kiro/settings/mcp.json as an ordinary config file rather than as an execution surface: because any MCP server the file names is auto-launched as a subprocess with the user’s privileges, the file-write tool’s scope silently contained arbitrary code execution the platform never proved it should hold. Rehberger’s July 2025 disclosure made this concrete twelve months ago — his write-to-mcp.json chain even reached a Kiro approval popup, and the reload proceeded regardless of the user’s click; the popup was UI theater guarding a boundary the model was expected to police.

Each of the three documented instances of this class was patched by extending an allowlist of “protected paths” that require explicit approval before write. The 2025 Rehberger disclosure added a Supervised-mode prompt and left Autopilot mode exposed. The 2026 Cymulate disclosure added .vscode/tasks.json. The 2026 Intezer disclosure added mcp.json, .git/, and additional entries. None of the three fixes changed the underlying architectural pattern: an LLM-driven file-write tool retains scope that reaches paths the runtime auto-loads as executable, and the gate on that reach lives in a per-path allowlist rather than in an isolation of the tool from any execution-adjacent surface. The gap between what the write tool held (any path in $HOME) and what “summarize a page” exercised (nothing) was auditable at deploy time without waiting for the exploit to fire.

SecurityV0 Perspective

SecurityV0 classifies this pattern as unproven_execution: a file-write capability became a code-execution capability through an auto-loaded configuration path. The control question is not whether the agent was allowed to write files in general. It is whether the specific task justified writing to an execution surface and launching a new process.

Security teams should be able to reconstruct four facts: which agent identity held the write capability, what task the operator requested, which content triggered the write, and whether an approval boundary was enforced. CVE-less advisories make that authority record more important, because vulnerability scanners alone will not identify every exposed fleet.

What To Do

  • Upgrade Kiro to v0.11.130 or later immediately. The Intezer variant received no CVE, so vulnerability scanners will not flag unpatched installs. Query kiro --version on every developer workstation and enforce the minimum in your endpoint compliance policy, not in a monthly patch report.
  • Enumerate every agent tool whose file-write scope reaches an auto-loaded execution surface. Beyond mcp.json: .vscode/tasks.json, .vscode/settings.json (bash allowlist), .git/hooks/*, shell rc files, ~/Library/LaunchAgents/*.plist, ~/.config/systemd/user/*.service, .claude/settings.json hooks, .cursorrules, CLAUDE.md. Any tool whose scope intersects that set is a de-facto RCE tool.
  • Gate execution-adjacent writes at the platform layer, not in the model. An LLM-rendered approval prompt guarding an LLM-driven write is the model policing the model. Move the gate below the agent runtime: an OS-level file-access broker, a per-path capability system, or a signed-config layer the model process cannot bypass.
  • Treat “protected paths” allowlists as symptomatic patches, not structural fixes. Every Kiro allowlist extension over twelve months has closed the last observed path and left the pattern intact. Ask any agentic-IDE vendor how the file-write tool is architecturally isolated from execution-adjacent paths, not which paths made the allowlist this quarter.
  • Track CVE-less advisories against your agent fleet. AWS assigned CVE-2026-10591 to the Cymulate variant but not to Rehberger’s 2025 chain or Intezer’s 2026 chain. Subscribe to vendor security bulletins (aws.amazon.com/security/security-bulletins/) directly and ingest them into your asset inventory alongside NVD feeds; the gap between the two is where operator visibility fails.

Sources

All posts