On July 20, 2026, Intezer published research showing that AWS Kiro, Amazon’s agentic IDE, could be driven to remote code execution by nothing more than a web page it was asked to read. Kiro loads its list of Model Context Protocol servers, including the exact command used to start each one, from ~/.kiro/settings/mcp.json. The agent can write that file itself using the fsWrite tool without user approval, and Kiro reloads the file automatically when it changes.
That combination closes the loop. The attacker hosts a page containing hidden prompt-injection instructions. The user asks Kiro to fetch or summarize the URL and approves the fetch, which looks like an entirely routine request. Kiro processes the hidden instructions and writes a malicious MCP server entry without asking. The configuration reloads and launches the attacker’s command on the host with the developer’s privileges. The user approved reading a page; the machine executed a program.
Intezer confirmed the chain on Kiro v0.9.2 and v0.10.16, and reports it was patched in v0.11.130. Intezer’s disclosure timeline records the issue reported on February 11, 2026, the fix deployed on April 3, 2026, and the CVE issued on July 22, 2026. AWS tracks it as CVE-2026-10591 in security bulletin 2026-037-AWS, describing “insufficient access control restrictions in the file write tool in Kiro IDE prior to version 0.11” that “might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths,” with no workaround other than upgrading.
The general lesson outlives the specific bug. An agent’s own configuration files are a trust boundary, and any agent that can write the file describing which programs it launches has an unbounded privilege escalation built into it. If you are deploying agentic coding tools, the question to ask of each one is simple: which files can the agent write without approval, and does any of them get executed or auto-loaded afterwards.