AWS Kiro RCE: When HTML Poisoning Turns into System Compromise
Has anyone else dug into the AWS Kiro vulnerability reported today? It feels like we are regressing to the early days of XSS, but instead of stealing cookies, the attacker gets a shell on the developer's box.
The research from Intezer and Kodem shows that the vector is terrifyingly simple: hidden text on a webpage. When Kiro is asked to summarize a page, it parses invisible text (like HTML comments), interprets it as a high-priority instruction, and overwrites its own configuration file to execute arbitrary code.
The most frustrating part? AWS patched it, but did not assign a CVE. Without a CVE, our vulnerability scanners are essentially blind to this risk, and asset management teams won't prioritize the patch.
Until agents have built-in adversarial input filtering, we need to rely on runtime integrity checks. Here is a quick inotifywait one-liner for those running Kiro on Linux dev boxes to alert on unauthorized config changes:
inotifywait -m -e modify,create,delete --format '%T %w%f %e' --timefmt '%H:%M:%S' ~/.kiro/ | while read time file event; do
logger -t KIRO_AGENT_WATCH "[$time] Suspicious Kiro activity: $file $event"
# Optional: killall -9 kiro to stop the execution chain
done
This is a band-aid, but without a CVE ID to track in our SBOMs, it's hard to enforce a baseline. How are you guys handling agent-based security when standard vulnerability management falls short?
This is exactly why we treat AI IDEs like untrusted browsers. We run Kiro and similar tools in a strict Firecracker microVM with no internet access unless explicitly proxied. The risk of 'Prompt Injection' turning into 'System Compromise' is too high for our prod environments. No CVE means no ticket for our patching team, so isolation is the only control we can rely on right now.
Great script idea. We took a slightly different approach using Falco to monitor the process tree. We set up a rule to alert if kiro-bin forks a shell or writes to ~/.kiro/config. outside of a known update window.
- rule: Unauthorized Kiro Config Modification
condition: >
proc.name = "kiro-bin" and
fd.name contains ".kiro/config." and
not proc.cmdline contains "--update"
output: >
Kiro rewriting config manually (user=%user.name command=%proc.cmdline)
priority: WARNING
It catches this behavior immediately without needing a file watcher script on every endpoint.
I tested this in our lab after reading the article. It's silent too—no pop-ups, no approval dialogs, just executes. The fact that hidden text is parsed and acted upon is a fundamental design flaw in how these 'agentic' models prioritize instructions. We need a 'human-in-the-loop' for any file system write operations, period.
The silent execution is the most dangerous aspect here. While runtime monitoring is crucial, File Integrity Monitoring (FIM) can catch the persistence attempt earlier. We're testing an auditd rule to flag any modifications to Kiro's config directory immediately:
-w /home/*/.kiro/config -p wa -k kiro_config_change
This alerts on write or attribute changes, giving you a heads-up before the malicious config is loaded. Has anyone seen this vector affecting other AI coding assistants yet?
Great insights everyone. Beyond containment, I'd recommend implementing a sanitization layer before content reaches Kiro. We've been successfully using DOMPurify configured to strip HTML comments completely:
const DOMPurify = require('dompurify');
const clean = DOMPurify.sanitize(dirtyHTML, {
FORCE_BODY: true,
REMOVE_COMMENTS: true
});
This eliminates the invisible text vector. We also route all fetched content through this sanitizer first, which gives us a centralized point for logging and analysis. Has anyone compared performance impact of sanitization versus microVM isolation for this use case?
Tanya’s sanitization is a great first step. To add a defense-in-depth layer, we enforce strict JSON schema validation on Kiro's configuration files during startup. This prevents execution even if the file is overwritten with malicious text. We use a simple wrapper:
ajv validate -s kiro_schema. -d ~/.kiro/config. || exit 1
kiro-bin
If the injected payload adds unexpected keys (like `exec_command`), the binary refuses to load the config.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access