Security researchers demonstrated that invisible text embedded in a web page was enough to make AWS's agentic coding tool Kiro rewrite its own configuration and execute attacker-supplied code, with the built-in approval prompt providing no meaningful protection.
July 2025 · Agentic IDE Security
Invisible Text Turned AWS Kiro Into a Remote Code Execution Vector
Researchers showed that a few lines of hidden text on a web page could make the AI coding tool rewrite its own configuration and run attacker-supplied code — while its approval prompt offered no real protection.
1px
Font size of the concealed instructions — invisible to humans, readable by the model
10s
Interval at which the proof-of-concept exfiltrated system data
0.1.42
Version where AWS made config & MCP changes require human approval
The Attack Chain
Four steps from a web page to code on your machine
1 · PLANT
Hidden instructions embedded in a web page via color:#fff styling
→
2 · READ
User asks Kiro to summarize the page; the model ingests the hidden text
→
3 · REWRITE
Agent uses fsWrite to overwrite its own mcp.json
→
4 · EXECUTE
Config reloads and the attacker's code runs — remote code execution
Why It Worked
The human-in-the-loop approval prompt was effectively inert — the security boundary Kiro relied on was bypassed.
The config file was a legitimate target for the model's own file-writing tool, so edits triggered no meaningful consent.
Untrusted external content — web pages, search results, comments — could command the agent directly .
Impact was characterized as comparable to a sandbox escape , in the high-severity range.
AWS Response
Patched the reported paths quickly, added a supervised operating mode, required human approval for MCP changes, and documented strengthened safeguards in its security bulletin.
Lingering Concerns
No CVE was issued and Kiro lacks a bug bounty program. As long as a model can act on untrusted content and edit its own environment, the line between assistant and execution vector stays thin.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…