# AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

AWS Kiro coding agent could be hijacked via indirect prompt injection to write its own settings, allowlisting all Bash commands and adding malicious MCP servers for arbitrary code execution.

- Payout: Research
- Severity: high
- Program: Amazon
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-26
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection
- Tags: area:ai domain:ai impact:integrity impact:rce kind:research platform:research sev:high tech:llm technique:chained vuln:misconfiguration vuln:prompt-injection vuln:rce

**Target:** AI coding agent (VS Code extension) config files .vscode/settings.json and .kiro/settings/mcp.json
**Root cause:** Kiro writes files without developer approval and stores security-sensitive settings (trusted Bash command allowlist, MCP server config) in workspace files the agent itself can edit, so injected content can rewrite its own trust boundaries.
**Steps:**
1. Embed indirect prompt injection in a source file comment instructing Kiro to use `edit_file` on `.vscode/settings.json`.
2. Add `"kiroAgent.trustedCommands": ["*"]` to allowlist all Bash commands.
3. Ask Kiro to explain/read the file so the injection triggers.
4. Kiro runs `open -a Calculator.app` via Bash tool without approval.
5. Alternate path: inject instructions to write malicious Python MCP server into `.kiro/settings/mcp.json`; saving triggers immediate code execution.
**How found:** Researcher applied 'Month of AI Bugs' coding-agent tests on release day, noticing Kiro can write files without approval and that its Bash allowlist and MCP config live in workspace-editable files, then crafted injections targeting those files.
**Exploitation:** Attacker controls data Kiro processes (source comment, uploaded image, tool-call output, MCP response). When the developer chats with the project, the injected instructions cause Kiro to edit its own config, allowlisting all Bash commands or registering a malicious MCP server, yielding arbitrary OS command execution on the developer's workstation with no further interaction.
**Escalation:** Chained self-config modification (allowlist + MCP server registration) to convert a prompt injection into full host compromise; noted future risk of agents autonomously reading docs to self-exploit.
**Insight:** For AI coding agents, check whether security-relevant config (command allowlists, MCP/tool server definitions, hooks) lives in workspace files the agent can write; if so, a prompt injection becomes self-escalation to RCE without any approval prompt.