A recently discovered flaw in AWS Kiro, an AI-driven Integrated Development Environment (IDE), exposes the potential for remote code execution through a hidden line of text on a webpage. This issue allows attackers to bypass the platform’s security measures, posing significant risks to developers.
The Human-in-the-Loop Security Model
Kiro operates under a ‘human-in-the-loop’ security model, necessitating user consent for executing actions that might be harmful, such as running shell commands or altering critical files. This design aims to ensure user oversight on AI activities.
However, researchers have identified a method to circumvent this security mechanism using prompt injection attacks from external content. The vulnerability arises from how large language models (LLMs) interpret inputs.
Unlike traditional systems that distinguish between data and executable commands, LLMs process all inputs as potential instructions, making prompt injection a notable threat.
Exploiting Hidden Text for Code Execution
The risk in Kiro is heightened by its excessive permissions and inadequate protection of vital configuration files. The Model Context Protocol (MCP) configuration file, located at ~/.kiro/settings/mcp.json, plays a central role in this vulnerability. This file, which outlines external tools and their commands, is unprotected and modifiable by the AI agent without user consent.
Attackers can exploit this by embedding concealed instructions within seemingly benign web content. If a developer requests Kiro to summarize documentation or retrieve a webpage containing these hidden instructions, Kiro will execute them.
In one demonstrated attack, a user retrieves external content, and Kiro interprets both visible and hidden data. The embedded instructions alter the MCP file with malicious content, allowing Kiro to execute arbitrary host system code without user knowledge.
Implications and Necessary Safeguards
A proof-of-concept exploit demonstrated how attackers could use a lightweight Node.js payload to gather system information such as hostname, username, and platform details, transmitting them to a remote server.
Although this demonstration involved harmless data collection, similar methods could enable credential theft or unauthorized access to source code. Users remain oblivious to the breach, believing they approved a routine web request, as no warnings are issued about file changes or code execution.
Nicole Fishbein from Intezer Research emphasizes that this vulnerability underscores the inadequacy of relying solely on user approval as a security measure in AI-powered tools. If AI agents can alter their execution environments without sufficient protection, the foundational trust model is compromised.
This concern is especially pertinent when IDEs have access to sensitive credentials or production environments. AWS has addressed this issue in updated Kiro versions, with fixes implemented in version 0.11.130, though a CVE identifier has not been assigned.
As AI agents become more integrated into development processes, this incident highlights the critical need for robust security measures, particularly regarding configuration file protection and control over high-risk actions. It serves as a reminder that even an invisible line of text can transform a useful coding assistant into a covert execution vector.
