Why it matters
Intezer and Kodem Security found that hidden instructions in a fetched web page could make AWS Kiro write a malicious MCP server into its own configuration and automatically execute it with the developer’s privileges. The prompt-injection chain bypassed meaningful approval, affected tested 0.9 and 0.10 builds, and was confirmed fixed in version 0.11.130; no in-the-wild exploitation was reported.
My takeaway: An agent must not be able to rewrite the policy or configuration that defines what it may execute. Protect control-plane files in every operating mode, bind approval to the exact write and command, isolate agent processes, and regression-test indirect prompt injection against all privileged configuration paths.