AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Brief
On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents.
AWS Kiro was vulnerable to arbitrary command execution via indirect prompt injection. This means that a remote attacker, who controls data that Kiro processes, could hijack it to run arbitrary operating system commands or write and run custom code.
In particular two attack paths that enabled this with AWS Kiro were identified: