Critical Vulnerability Discovered in AWS Kiro IDE

A vulnerability in AWS Kiro, an agent-based coding IDE from Amazon Web Services, has allowed attackers to execute code on developers' machines via a manipulated website. According to an investigation by Intezer in collaboration with Kodem Security, a simple command, such as merging a webpage, could lead Kiro to overwrite its own configuration file and execute unauthorized code. The vulnerability was discovered when researchers found that Kiro had not implemented an approval level for such requests. This meant that an attacker possessing a crafted webpage could manipulate the IDE without the developer receiving a warning or needing to provide confirmation. The ability to execute code without consent poses a significant risk to the security of development environments.

The researchers identified that the vulnerability could be exploited by inserting hidden text on a webpage. This technique allowed Kiro to change its configuration to respond to the attacker's requests. The discovery of this vulnerability raises questions about the security of IDEs that are widely used in software development. Following the disclosure of the vulnerability, AWS promptly responded and released an update to close the flaw. However, the company has not published a specific CVE number for this vulnerability, which has caused confusion in the security community.

AWS's swift response demonstrates that the company takes the security of its products seriously. The discovery of this vulnerability could also impact the use of Kiro in enterprises that rely on the IDE for their development projects. Security researchers recommend that companies review their security policies and ensure that all tools in use are regularly checked for vulnerabilities. The investigation by Intezer and Kodem Security has also highlighted the need for developers to be aware of the risks associated with using cloud-based development environments. The possibility that an IDE can be configured without the user's consent could lead to a serious security incident if attackers continue to exploit this technique.

The vulnerability in AWS Kiro is an example of how crucial it is to implement security practices in software development. Developers should be aware of potential risks and ensure that they take appropriate security measures to protect their systems. Security research will continue to play a vital role in identifying and addressing such vulnerabilities. The vulnerability was made public on July 22, 2026, and AWS has already provided the update to remediate the issue.