What happened
Kiro IDE file write tool (versions before 1.0.242) 'might allow remote unauthenticated actors to inject crafted instructions into the agent's context'. When a user runs the agent in a crafted repository treated as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths (~/.kiro), persisting attacker control across sessions. Amazon fixed in 1.0.242 and advises reviewing ~/.kiro for unexpected entries.
Why it matters
AI coding agents trivially process untrusted repository content. This persists injected instructions into the agent's global configuration in the attacker-controlled workspace, so subsequent agent runs keep following attacker instructions - a self-persisting form of agent hijacking that can exfiltrate source/credentials on developer machines.
Attack vector
User runs the Kiro agent in an attacker-crafted repository; agent writes injected instructions to auto-loaded global config paths (~/.kiro), persisting malicious behavior across future agent runs.
Affected systems
Amazon Kiro IDE < 1.0.242 (macOS/Windows/Linux)
Mitigation
Upgrade to Kiro IDE 1.0.242+; review ~/.kiro global config for unexpected entries after using untrusted workspaces.