AWS Kiro IDE could be hijacked by hidden text on any webpage
Intezer and Kodem Security discovered that a single invisible pixel of text on a web page can trick Kiro, AWS’s AI‑powered coding IDE, into rewriting its own config file and executing attacker‑provided code on the developer’s machine, bypassing the required “allow” prompt. AWS has issued a patch, but no CVE has been assigned yet.