Opening SecureFlowKiro Global MCP Configuration Write to Host Code Execution
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Intezer Research and Kodem Security aidefend-sf0055

Kiro Global MCP Configuration Write to Host Code Execution

  • Autonomous Agents
  • System Compromise & RCE
  • Model Evasion & Bypass

Intezer and Kodem demonstrated that hidden instructions in a web page fetched by Kiro could induce its file-write tool to change ~/.kiro/settings/mcp.json without a meaningful approval boundary. Kiro reloaded the configuration and started the added MCP server command in the developer's user context. The proof of concept sent a local callback; it did not document an in-the-wild victim or theft of secrets.

Mapped threat techniques

  • AML.T0051.001 LLM Prompt Injection: Indirect
  • AML.T0081 Modify AI Agent Configuration
  • AML.T0053 AI Agent Tool Invocation
  • AML.T0025 Exfiltration via Cyber Means

Source

Updated