--- title: "AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591" description: "CVE-2026-10591: hidden 1px text on a web page made AWS Kiro rewrite its own mcp.json and auto-reload it, executing attacker code. Fixed in v0.11.130." url: "https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591 ![Anomity robot illustrating AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591] Advisory High # AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591 Anomity Research Anomity Threat Research · Aug 5, 2026 · 7 min read Share: Copied Agent Self-Modification · High · CVE-2026-10591 (CVSS 3.1 8.8 / CVSS 4.0 8.6) · Aug 5, 2026 Affected AWS Kiro before 0.11.34 - including v0.9.2 on macOS and v0.10.16 on Ubuntu; fixed from v0.11.130 (current stable 1.0.165 as of July 21 2026) **CVE-2026-10591** is a **High**-severity flaw in **AWS Kiro** - CVSS 3.1 **8.8**, CVSS 4.0 **8.6** - in which invisible text on an ordinary web page caused the agent to **rewrite its own MCP server configuration** and then **auto-reload it**, launching an attacker-defined MCP server as code execution under the developer's account. The hidden instructions were styled `color:#fff;font-size:1px`; the developer only had to ask Kiro to fetch or summarise the page. Reported by **Intezer** and **Kodem Security** via HackerOne on **February 11, 2026**, fixed **April 3, 2026** and verified in **v0.11.130**. This advisory covers the mechanism, why *the agent editing its own guardrail* is a distinct failure class, and how AWS's fix - a **protected paths** list - is the right shape of answer. ## What happened Kiro is AWS's agentic IDE. Like other MCP clients it reads a configuration file - `~/.kiro/settings/mcp.json` - listing the MCP servers it should launch. Because an MCP server is started as a local child process with the user's permissions, that file is effectively **a list of programs the agent will run on your behalf**. Its integrity is the boundary. The attack needed no exploit primitive beyond text. An attacker put instructions on a web page in **white 1-pixel type** - invisible to a reader, plainly legible to a model ingesting the DOM. A developer asked Kiro to fetch or summarise that page. Kiro read the concealed instructions as input, and **modified ~/.kiro/settings/mcp.json without asking for approval**. The client then **auto-reloaded** the configuration and started the newly declared server. The result is remote code execution running as the developer, which the reporting researchers translate into the obvious follow-ons: **credential theft, source-code exfiltration, persistence, and lateral movement**. Two design decisions turned a prompt-injection into an RCE. First, the agent had **write access to its own configuration** with no separate approval for that file. Second, the client **reloaded the config automatically**, so there was no moment at which a human could notice a new server had appeared. In Kiro's autonomous mode there was no effective prompt in the path at all. Neither decision is unusual - both are ordinary conveniences - and together they mean untrusted text on a web page could choose what programs the IDE runs. AWS's remediation is worth reading closely because it generalises. Rather than trying to detect malicious instructions, they moved sensitive files - **mcp.json**, **.vscode/tasks.json**, **.git** - onto a **protected paths** list that **requires explicit approval before a write**, and enforced it in **both Autopilot and Supervised modes** so the model cannot bypass it by changing its own operating mode. That is the correct instinct: treat the config as a boundary object and put the check below the model, where a prompt cannot argue with it. Note that `.vscode/tasks.json` appears on that list - the same file the Shai-Hulud npm worm planted a `folderOpen` task into, which suggests AWS was looking at the whole class rather than the single report. Detail Value Identifier CVE-2026-10591 Severity CVSS 3.1 8.8 / CVSS 4.0 8.6 (High) Product AWS Kiro (agentic IDE) Affected Before 0.11.34 - includes v0.9.2 (macOS) and v0.10.16 (Ubuntu) Fixed in v0.11.130 onward (current stable 1.0.165 as of July 21 2026) Vector Indirect prompt injection via hidden text (`color:#fff;font-size:1px`) on a fetched web page Mechanism Agent rewrites `~/.kiro/settings/mcp.json` without approval, client auto-reloads, attacker's MCP server launches Impact RCE as the developer - credential theft, source exfiltration, persistence, lateral movement Reported by Intezer and Kodem Security, via HackerOne Timeline Reported Feb 11 2026; fixed Apr 3 2026; verified in v0.11.130 Vendor fix Protected paths (`mcp.json`, `.vscode/tasks.json`, `.git`) require explicit approval, enforced in Autopilot and Supervised modes ## Why this is an agentic-endpoint risk Most prompt-injection findings end at *the model said something it shouldn't*. This one ends at *the model changed which programs run on the machine*. The distinction matters because it defines a specific class: **agent self-modification**, where the target is not data but the agent's own configuration - the file that defines its capabilities. Once an agent can write its own config and the client reloads it, **injection becomes persistence**. The next session starts already compromised, and nothing about it looks like an attack. It is also the same class as [DuneSlide in Cursor](https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/), where the agent overwrote the **sandbox helper binary itself** rather than a config file. Different file, identical logic: the agent had write access to the thing that was supposed to constrain it. And it rhymes with the [DeepJack](https://anomity.ai/blog/deepjack-cursor-deeplink-mcp-install-rce/) and [PromptFiction](https://anomity.ai/blog/promptfiction-claude-desktop-url-scheme-one-click/) deeplink flaws, where the install and consent handoffs were the weak point. In each case the exploited component was a legitimate, documented feature. Your existing controls have very little to work with here. The injection arrives as **rendered text on a page you asked the agent to read**, so there is no payload for a scanner. The config write is a signed IDE editing a dotfile in the user's home directory. The resulting child process is a package manager fetching a package. EDR, DLP and network monitoring all see routine developer activity. What is actually diagnostic is far simpler and nobody watches it: **did the set of MCP servers on this endpoint change, and did a human ask for that?** MCP servers are one of the [eight AI artifact types](https://anomity.ai/#features) Anomity inventories per endpoint, and they proliferate the way [AI agents became the new shadow IT](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/) - which is why the change usually goes unnoticed. The general mechanism is covered in [indirect prompt injection explained](https://anomity.ai/blog/indirect-prompt-injection-explained/). ## How Anomity surfaces and governs it First, **treat the config as an inventoried artifact, not a file**. Anomity's unprivileged Endpoint Sensor runs on Windows, macOS and Linux and inventories MCP servers alongside AI agents, extensions, plugins, skills, secrets, hooks and CLIs. Each server carries a **first-seen timestamp** and the endpoint it appeared on, so a server that wrote itself into `mcp.json` shows up as **a new artifact with no corresponding request** - which is exactly the signal this attack produces, and the one thing it cannot hide. Second, **decide at the tool call**. AWS's protected-paths fix is the right idea implemented per-product; the fleet-wide version is a boundary that applies regardless of which agent is running. Where an agent exposes a hook - for example the **PreToolUse** event in Claude Code - Anomity evaluates each call against policy and returns **allow, deny, or log** before it runs. A write to a config path, or a freshly launched server immediately reading `~/.aws/credentials`, meets a check the model cannot talk its way past. That is what [runtime governance](https://anomity.ai/#runtime-governance) provides when the instruction itself is untrustworthy. Third, **keep the record**. Artifact changes, version changes and policy decisions land in a [queryable 90-day audit trail](https://anomity.ai/#outcomes), so you can answer which endpoints ran Kiro before 0.11.34, whether any `mcp.json` changed during that window, and what the resulting servers did. Anomity collects **metadata only**, with **on-endpoint secret redaction**, so the credentials this attack targets are never centralized. Findings route to **SIEM, Slack, email, or Jira**, the platform is **SOC 2 Type II**, and it [complements EDR, DLP, network and GRC tooling](https://anomity.ai/#compare). See [how it works](https://anomity.ai/#how-it-works). > You can't govern what you can't see. The Anomity principle ## What to check across your fleet - Inventory every endpoint running AWS Kiro and record the version; anything before 0.11.34 is affected, and the fix landed in v0.11.130 - verify the running build rather than trusting the updater. - Diff ~/.kiro/settings/mcp.json on every Kiro endpoint against what a human actually approved. A server nobody requested is the primary indicator, and it survives the patch. - Extend the same reconciliation to the other clients' config files - .cursor/mcp.json , .vscode/mcp.json , .claude/settings.json - since the flaw is a pattern, not a product. - Confirm that config writes require approval in your agents' most autonomous mode, not just the supervised one. Kiro's fix enforces protected paths in both Autopilot and Supervised precisely so the model cannot switch modes to escape it. - Check whether your clients auto-reload configuration. Auto-reload is what removes the human moment between a config change and a new process starting. - For any endpoint that ran a vulnerable build and fetched untrusted web content, treat it as a potential incident: review MCP server history, then rotate developer credentials the agent could reach - cloud keys, npm and GitHub tokens, SSH keys, and anything in a shell profile. - Move MCP servers to a reviewed set rather than per-developer discretion, per building an MCP server registry , so an unrequested entry is detectable by comparison. - Ensure agent tool calls are evaluated at a hook with allow/deny/log - see Claude Code permissions and hooks hardening - and run the credential path of your AI agent incident response playbook rather than improvising. CVE-2026-10591 is the cleanest statement yet of the agent-layer problem: **the agent edited the boundary that was supposed to contain it, on instructions from a web page, and then reloaded it without asking.** AWS's protected-paths fix is genuinely good and worth copying as a pattern - decide below the model, where a prompt cannot negotiate. Patch to v0.11.130 or later, then reconcile the MCP servers actually present on your fleet against the ones anyone asked for. For the surrounding trust model see the [MCP Server Security guide](https://anomity.ai/blog/mcp-server-security-complete-guide/), the sibling [DuneSlide advisory](https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/) for the same class against a sandbox binary, and [ADLC](https://anomity.ai/blog/adlc-agentic-development-lifecycle-guide/) for where this belongs in a lifecycle. To see which endpoints carry MCP servers nobody requested, [book a demo](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions What is CVE-2026-10591 in AWS Kiro? CVE-2026-10591 is a High-severity vulnerability (CVSS 3.1 8.8, CVSS 4.0 8.6) in AWS Kiro, the agentic IDE. Hidden text on a web page - styled color:#fff and font-size:1px, so invisible to a human but fully legible to a model reading the DOM - could instruct Kiro to rewrite its own MCP server configuration at ~/.kiro/settings/mcp.json without asking for approval. Kiro then auto-reloaded the configuration and launched the attacker-defined MCP server, producing remote code execution under the developer's account. The developer only had to ask Kiro to fetch or summarise the poisoned page. It was reported by Intezer and Kodem Security through HackerOne on February 11 2026 and fixed on April 3 2026, verified in v0.11.130. Which versions are affected and which contains the fix? Versions before 0.11.34 are affected, including v0.9.2 on macOS and v0.10.16 on Ubuntu. The fix is present from v0.11.130 onward, and current stable was 1.0.165 as of July 21 2026. Because the vulnerable window was long, patching alone is not sufficient remediation: the attack's outcome is a persistent entry in mcp.json, which survives the upgrade. Diff the config on every Kiro endpoint against servers a human actually approved, and treat an unexplained entry as a potential compromise of that machine rather than a misconfiguration. Why does rewriting mcp.json amount to code execution? Because mcp.json is not a preferences file, it is a list of programs the agent will launch. MCP servers are started as local child processes with the user's own permissions - no sandbox, no capability restriction, no syscall filtering - and over stdio they inherit environment variables from the shell. So an attacker who controls an entry in that file controls a process that runs with the developer's file access, tokens, source code and network egress. Combined with auto-reload, writing the config is equivalent to running a command, with the added property that it persists into every future session. How did AWS fix it, and is that the right approach? AWS moved sensitive files onto a protected paths list requiring explicit approval before any write - specifically including mcp.json, .vscode/tasks.json and .git - and enforced it in both Autopilot and Supervised modes so the model cannot bypass the check by changing its operating mode. That is the right shape of fix, because it does not attempt to detect malicious instructions. It places the decision below the model, where a prompt cannot negotiate with it. The inclusion of .vscode/tasks.json is notable: that is the same file the Shai-Hulud npm worm planted a folderOpen task into, which suggests AWS addressed the class rather than only the reported instance. What is agent self-modification, and why treat it as its own class? Agent self-modification is when the target of an attack is not data but the agent's own configuration or guardrails - the artifacts that define what it is allowed to do. It deserves its own class because the consequence is qualitatively different from ordinary prompt injection: injection normally ends when the session ends, but a rewritten config persists, so the next session starts already compromised and looks entirely normal. CVE-2026-10591 rewrote mcp.json; DuneSlide in Cursor (CVE-2026-50548 and CVE-2026-50549) overwrote the sandbox helper binary itself. Different files, same logic - the agent had write access to the mechanism meant to constrain it. Why don't EDR, DLP or network monitoring catch this? Because every individual step is ordinary. The injection arrives as rendered text on a page the developer explicitly asked the agent to read, so there is no file or payload for a scanner to examine. The config change is a signed, sanctioned IDE writing a dotfile in the user's own home directory. The resulting child process is typically a package manager fetching a package, which is the most routine event on a developer machine. And the exfiltration leg, if it comes, is an authenticated request to a legitimate API. What is actually diagnostic is much simpler and rarely monitored: the set of MCP servers on the endpoint changed, and no human requested it. ## Related [Advisory Critical ### DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) DuneSlide: two CVSS 9.8 flaws let zero-click prompt injection overwrite Cursor's own sandbox binary, turning sandboxed commands into full RCE. Anomity Research · Aug 5, 2026 · CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8), named DuneSlide by Cato Networks](https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/) [Advisory High ### BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628 An ordinary browser extension can impersonate the vendor page that commands a built-in AI agent, then drive it. Five browsers, two CVEs, zero clicks. Anomity Research · Sep 18, 2026 · CVE-2026-0628, CVE-2026-55945](https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/) [Advisory Critical ### GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code Manifold's GitSpawn (Sep 1 2026): malicious .git/config core.fsmonitor runs on git status/diff during agent context gather - outside sandbox, no approval. Patched in goose, Codex, Cursor, Claude Code; several agents still open. Anomity Research · Sep 14, 2026 · GitSpawn (Manifold, 2026-09-01); CVE-2026-72718 (goose), CVE-2026-19592 (Codex CLI), CVE-2026-71963 (Hermes)](https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591", "description": "CVE-2026-10591: hidden 1px text on a web page made AWS Kiro rewrite its own mcp.json and auto-reload it, executing attacker code. Fixed in v0.11.130.", "datePublished": "2026-08-05", "dateModified": "2026-08-05", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "Agent Self-Modification", "url": "https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/", "keywords": "Kiro CVE-2026-10591 mcp.json, CVE-2026-10591 (CVSS 3.1 8.8 / CVSS 4.0 8.6), CVE-2026-10591, AWS Kiro, mcp.json, indirect prompt injection, agent self-modification, protected paths, RCE, agentic AI security" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is CVE-2026-10591 in AWS Kiro?", "acceptedAnswer": { "@type": "Answer", "text": "CVE-2026-10591 is a High-severity vulnerability (CVSS 3.1 8.8, CVSS 4.0 8.6) in AWS Kiro, the agentic IDE. Hidden text on a web page - styled color:#fff and font-size:1px, so invisible to a human but fully legible to a model reading the DOM - could instruct Kiro to rewrite its own MCP server configuration at ~/.kiro/settings/mcp.json without asking for approval. Kiro then auto-reloaded the configuration and launched the attacker-defined MCP server, producing remote code execution under the developer's account. The developer only had to ask Kiro to fetch or summarise the poisoned page. It was reported by Intezer and Kodem Security through HackerOne on February 11 2026 and fixed on April 3 2026, verified in v0.11.130." } }, { "@type": "Question", "name": "Which versions are affected and which contains the fix?", "acceptedAnswer": { "@type": "Answer", "text": "Versions before 0.11.34 are affected, including v0.9.2 on macOS and v0.10.16 on Ubuntu. The fix is present from v0.11.130 onward, and current stable was 1.0.165 as of July 21 2026. Because the vulnerable window was long, patching alone is not sufficient remediation: the attack's outcome is a persistent entry in mcp.json, which survives the upgrade. Diff the config on every Kiro endpoint against servers a human actually approved, and treat an unexplained entry as a potential compromise of that machine rather than a misconfiguration." } }, { "@type": "Question", "name": "Why does rewriting mcp.json amount to code execution?", "acceptedAnswer": { "@type": "Answer", "text": "Because mcp.json is not a preferences file, it is a list of programs the agent will launch. MCP servers are started as local child processes with the user's own permissions - no sandbox, no capability restriction, no syscall filtering - and over stdio they inherit environment variables from the shell. So an attacker who controls an entry in that file controls a process that runs with the developer's file access, tokens, source code and network egress. Combined with auto-reload, writing the config is equivalent to running a command, with the added property that it persists into every future session." } }, { "@type": "Question", "name": "How did AWS fix it, and is that the right approach?", "acceptedAnswer": { "@type": "Answer", "text": "AWS moved sensitive files onto a protected paths list requiring explicit approval before any write - specifically including mcp.json, .vscode/tasks.json and .git - and enforced it in both Autopilot and Supervised modes so the model cannot bypass the check by changing its operating mode. That is the right shape of fix, because it does not attempt to detect malicious instructions. It places the decision below the model, where a prompt cannot negotiate with it. The inclusion of .vscode/tasks.json is notable: that is the same file the Shai-Hulud npm worm planted a folderOpen task into, which suggests AWS addressed the class rather than only the reported instance." } }, { "@type": "Question", "name": "What is agent self-modification, and why treat it as its own class?", "acceptedAnswer": { "@type": "Answer", "text": "Agent self-modification is when the target of an attack is not data but the agent's own configuration or guardrails - the artifacts that define what it is allowed to do. It deserves its own class because the consequence is qualitatively different from ordinary prompt injection: injection normally ends when the session ends, but a rewritten config persists, so the next session starts already compromised and looks entirely normal. CVE-2026-10591 rewrote mcp.json; DuneSlide in Cursor (CVE-2026-50548 and CVE-2026-50549) overwrote the sandbox helper binary itself. Different files, same logic - the agent had write access to the mechanism meant to constrain it." } }, { "@type": "Question", "name": "Why don't EDR, DLP or network monitoring catch this?", "acceptedAnswer": { "@type": "Answer", "text": "Because every individual step is ordinary. The injection arrives as rendered text on a page the developer explicitly asked the agent to read, so there is no file or payload for a scanner to examine. The config change is a signed, sanctioned IDE writing a dotfile in the user's own home directory. The resulting child process is typically a package manager fetching a package, which is the most routine event on a developer machine. And the exfiltration leg, if it comes, is an authenticated request to a legitimate API. What is actually diagnostic is much simpler and rarely monitored: the set of MCP servers on the endpoint changed, and no human requested it." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591", "item": "https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/" } ] } ```