AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Summary: Intezer, working with Kodem Security, found that hidden one-pixel white text on an ordinary API documentation page could make AWS's Kiro agentic coding IDE write an attacker-controlled Model Context Protocol server into ~/.kiro/settings/mcp.json and launch it with the developer's privileges, with no approval step able to stop it. AWS patched the issue, covered by CVE-2026-10591 and confirmed fixed in v0.11.130, after Intezer reported it through HackerOne on February 11, 2026.
Why it matters: Kiro's entire safety model rested on a human clicking allow, and the flaw bypassed that boundary without the developer ever being offered a choice - the only action they approved was fetching a URL. Three separate research efforts over roughly a year found the same shape of bug in Kiro, and researchers catalogued more than 30 similar flaws across AI coding tools including Cursor and Copilot in December 2025.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-10591
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026