[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCqIPfzGCLwRKR-pI7rStOTelgUeh90HKGCaw4pq9vKM":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a542c7a3-1e8f-42df-88e1-30ad818ab4bc","AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code","aws-kiro-flaw-let-a-poisoned-web-page-rewrite-its-config-and-run-code-ab0fde","Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been","A vulnerability in AWS's Kiro coding IDE allowed attackers to execute arbitrary code on developer machines by embedding hidden text on a web page. This hidden text could trick Kiro into rewriting its configuration file, leading to the execution of malicious commands without user approval. AWS has since patched the issue.","AWS Kiro flaw allowed poisoned web pages to rewrite config and execute code.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Faws-kiro-flaw-let-poisoned-web-page.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjJfMUQ_pVP5as41uM_4cR8oRUsCwuXPMLLG63jNd5Djqso9kJyQZLiZgQrMQzykhRaX8BQCydIMPokGoITYY30kc3dH-8iy4Bd-ux36RoIjyNYXtKwb1F1fPdP00hoHD-9Q9s5CGD30w58s5wfyzBGOQvnIxM8JlHkig881HSQQuu4Hk6GBiDJicUYE8o\u002Fs1600\u002FAWS-Kiro.jpg","2026-07-21T16:06:12+00:00","2026-07-21T18:00:21.708111+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Kiro","product",{"name":21,"type":22},"AWS","vendor",{"name":24,"type":19},"mcp.json",{"name":26,"type":19},".vscode\u002Fsettings.json",{"name":28,"type":19},".vscode\u002Ftasks.json",{"name":30,"type":22},"Intezer","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"url","http:\u002F\u002Flocalhost","Callback server used in Intezer's proof-of-concept to demonstrate code execution.",[21,30,18],{"controls":61,"vendors":145},[62,88,117],{"slug":63,"name":64,"problem":65,"products":66},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":85,"url":86,"description":87},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":48,"name":118,"problem":119,"products":120},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[146],{"slug":147,"name":30,"logo_path":148,"roles":149},"intezer","\u002Fvendor-logos\u002Fintezer.png",[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"prompt-injection-in-aws-kiro-ide-enabled-malicious-config-rewrites-and-code-execution","Prompt Injection in AWS Kiro IDE Enabled Malicious Config Rewrites and Code Execution","The AWS Kiro vulnerability stemmed from a prompt injection attack, where hidden text embedded in a web page could manipulate the AI-assisted IDE into rewriting its configuration file and executing arbitrary commands without user consent. This is a critical failure in configuration integrity — the IDE lacked sufficient validation to distinguish between legitimate user instructions and adversarially crafted external input. The attack required no special permissions; simply visiting a malicious web page was enough to compromise a developer's machine. This matters greatly because developer workstations are high-value targets that often have broad access to source code, cloud credentials, and CI\u002FCD pipelines. A single compromised developer environment can cascade into a full supply chain breach.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","NIST SP 800-53 CM-3: Configuration Change Control","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF ID.AM-2: Software platforms and applications are inventoried","OWASP LLM01: Prompt Injection (OWASP Top 10 for LLM Applications)","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1059: Command and Scripting Interpreter",{}]