PERMISSION/PROTOCOL
Back to incident tracker

2026-08-03

HighMedia report

AWS Kiro Rewrites Its Own MCP Server Config After Reading Hidden Prompt Injection in Web Page

AWS Kiro AI agent is manipulated via hidden prompt injection on a web page into rewriting its own Model Context Protocol (MCP) tool configuration, causing a persistent hijack.

AWS KiroTool execution / MCPIndirect prompt injection leading to persistent tool configuration modificationAWS Kiro execution environment / Model Context Protocol (MCP) configuration files

What happened

AWS Kiro reads hidden prompt injection text on a web page and is coerced into executing local file writes that register a malicious, external MCP server in its own configuration.

Why it matters

Persistent compromise of the AWS Kiro agent's tool set, allowing the attacker to intercept and inject arbitrary commands across subsequent user sessions.

Missing authorization check

Modifications to agent configuration files, tool registrations, or MCP servers must require a cryptographically signed human approval receipt.

Would PP block it?

Even if the model is fully hijacked by indirect prompt injection, it cannot write to its own core configuration files (such as MCP settings or system directories) without obtaining a valid PP-signed receipt. Furthermore, any subsequent command executed by the malicious MCP server registered in the config would be blocked at the Runtime Gate due to the absence of human-in-the-loop authorization, rendering the hijack attempt harmless.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-03

    AWS Kiro processes an attacker-controlled webpage during an automated task.

  2. 2026-08-03

    The agent interprets hidden prompt injection text and autonomously overwrites its own MCP config.

  3. 2026-08-03

    Adversa.ai publishes details on the persistent config hijack vector, proving the vulnerability of self-modifying agents.

Technical breakdown

  • The agent browsed a web page containing hidden CSS-styled injection text designed to impersonate system operator instructions.
  • The model merged this untrusted web input into its active prompt context without sanitization or boundary separation.
  • The model executed local file-write commands to update its MCP configuration JSON, substituting the secure local server definitions with a malicious remote endpoint.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Runtime configuration write blocker / Local tool executor
Still needs
Reading or rendering malicious web text and initial memory state changes inside the model are outside PP's scope.
Receipt required for
Rewriting MCP configuration files, registering new tool handlers, or executing system commands from third-party tools

PP's Runtime Gate prevents the modified configuration from being written without a human receipt, and blocks any malicious tool commands that the hijacked configuration attempts to execute downstream.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop