> TritonInfoSec News
Home / Jul 23, 2026 / Story
0
#10 The Hacker News general July 21, 2026 at 16:06 UTC

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

By [email protected] (The Hacker News)

AI Summary

A prompt injection vulnerability in AWS Kiro, Amazon's agentic coding IDE, allowed a poisoned web page to instruct Kiro to rewrite its own configuration file and execute arbitrary attacker-controlled code on the developer's machine with no approval step able to block it. Discovered jointly by Intezer and Kodem Security, AWS patched the issue with no CVE assigned. The attack required nothing more than asking Kiro to summarize a malicious page, illustrating the RCE risk inherent in agentic AI development tools.

Read full article → https://thehackernews.com/2026/07/aws-kiro-flaw-le…

Relevance score: 81.0/100

# More from July 23

  1. 1
    OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark The Hacker News
  2. 2
    Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA The Hacker News
  3. 3
    Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC The Hacker News
  4. 4
    Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data The Hacker News
  5. 5
    Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication The Hacker News
  6. 6
    Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents The Hacker News
  7. 7
    CISA orders urgent action on actively exploited Langflow RCE flaw BleepingComputer
  8. 8
    Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs The Hacker News
  9. 9
    LG to Ban Residential Proxies from Smart TV Apps Krebs on Security