AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

A flaw in AWS's Kiro agentic coding IDE allowed hidden text on a web page to rewrite its configuration and execute attacker code on a developer's machine. Intezer and Kodem Security found that asking Kiro to summarize a page could trigger remote code execution with no approval step. AWS has patched the issue; no CVE has been assigned.