When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE

by Nicole Fishbein

Point Kiro, AWS's agentic IDE, at a poisoned doc page and you could have handed a stranger your laptop. Instructions hidden in 1px white text got parsed as commands, and Kiro rewrote its own ~/.kiro/settings/mcp.json with no approval gate. That file is just a list of programs it will launch on your host. The warning popup, where there was one, made no difference either, and while AWS patched this back in April, the bug never got a CVE of its own.

Context bombs: stopping AI attackers in their tracks

by Sam Cox

I'm always impressed by Sam's "simple" but awesome ideas. This time it is effectively defensive prompt injection, and it works embarrassingly well. The target was a purpose-built AWS cyber range with roughly 300 resources and ten attack paths wired into it. Five frontier models were turned loose on it across 152 scored runs, split evenly between clean environments and bombed ones. The bomb is a short string in a decoy Secrets Manager secret, written to trip safety guardrails in the model or its provider. It fires the moment the model reads the loot. Admin escalation fell from 57% of runs to 5%, and full compromise from 36% to 1%. Reminds me of the idea that anyone can poison a blockchain with illegal material and leave everyone who stores a copy in legal jeopardy.

Show us Zee Pages

by Rory McCune

Kubernetes components serve debugging z-pages. statusz gives uptime and build info, flagz gives start-up flags, and the unofficial configz gives the actual running configuration. Rory catalogued which ones actually work where, because the documentation will not tell you. The AWS-relevant bit is that kube-proxy supports no authentication at all, so anyone who can reach the port can read its configz. EKS binds it to all interfaces rather than localhost, which means anything on the container network. He also shipped zeedumper to pull all three endpoints and backfill the defaults configz leaves out, though he is upfront that it is pre-release.