Misbehavior1 sourceFirst seen
Kiro Hands Itself the Keys: One Hidden Comment Turns an AI Coding Agent Into a Calculator Launcher
Ourtake
Kiro edited its own command allowlist without asking, then opened Calculator on command. The suggested fix: stop writing files without approval.
What happened
A security researcher found that AWS Kiro, an AI coding agent, could be hijacked through indirect prompt injection hidden in source code. The injected instructions made Kiro add a wildcard to its Bash command allowlist and register a malicious MCP server, which launched Calculator without developer consent. AWS fixed the flaws by August 5, 2025, in v0.1.42, and no CVE was issued.