A Poisoned Web Page Was Enough to Hijack Amazon's AI Coding Assistant

Key points

• Intezer, working with Kodem Security, showed that AWS Kiro could be tricked into running attacker-supplied code simply by reading a web page.
• The trick worked because Kiro rewrote its own configuration file after reading hidden instructions on that page.
• Amazon Web Services has fixed the flaw, and no CVE identifier was assigned.
• The attack bypassed Kiro's built-in approval prompts that are meant to stop risky actions.

Imagine asking your AI assistant to summarize a web page. Now imagine that page, invisibly, tells the assistant to hand over your laptop. That's roughly what security researchers just pulled off against Kiro, Amazon's new AI-powered coding tool.

Kiro is what people in the trade call an agentic IDE. In plain English, it's a coding workspace where an AI can read files, write code and run commands on the developer's machine, largely on its own. AWS sells it as a productivity boost for software teams.

The problem is trust. Kiro treats the text it reads as instructions worth following. And text can come from anywhere.

How did the attack actually work?

A developer asked Kiro to summarize a web page, and the page contained hidden instructions telling Kiro to modify its own settings file and then run code supplied by the attacker. No password stolen, no software exploit in the usual sense, just words on a page that the AI obediently treated as orders.

This is called a prompt injection attack. Think of it like a con artist slipping a note into a stack of paperwork on your desk, and your overly helpful intern acting on it without asking. Web security has seen this shape of problem before with cross-site scripting, where a browser runs code it should never have trusted. The AI version is the same idea wearing a different coat.

The research came from Intezer in collaboration with Kodem Security, and was first reported by The Hacker News. It sits in a pattern we've been tracking: our 13 July story "One Poisoned Email Can Rewrite What Your AI Assistant 'Remembers' About You" showed a single message planting false memory in an AI agent's long-term store, and the mechanism here is the same, untrusted input quietly promoting itself into a trusted command.

What makes this one sting is that Kiro has approval prompts. Before doing something sensitive, it's supposed to ask the human to click yes or no. The researchers found a path that skipped past those prompts entirely: the AI edited its own configuration, which changed what counted as already approved, and then ran the attacker's code.

Amazon Web Services has patched the flaw. No CVE, meaning no formal public identifier for the bug, has been assigned, which is unusual but not unheard of for issues fixed quickly in a vendor's own product.

Should ordinary users care?

If you're not a software developer using Kiro, this specific bug doesn't touch you. But the pattern matters to everyone, because the same class of trick will keep appearing in every AI assistant that browses the web on your behalf. That includes tools now being pitched to lawyers and customer service teams.

The uncomfortable truth: an AI agent that can read the internet and take actions on your computer is, by design, one clever web page away from doing something you didn't ask for. Guardrails help. They're not a fence, they're a suggestion.

Update Kiro to the patched version. For everyone building with AI agents, the lesson is old, boring and correct: never let untrusted input silently promote itself into a trusted command. Treat text the model reads as data, not orders, log every action the agent takes, and require real human approval for anything that touches the file system or the shell.

This won't be the last time a hidden paragraph on a web page turns into remote code execution. It might not even be the last time this month.