Kiro IDE CVE-2026-95985 and CVE-2026-89332: Agent Writes Its Own Config

AWS published two security bulletins for Kiro IDE, its agentic code editor, in September 2026. Bulletin 2026-111-AWS (CVE-2026-89332, 11 September) covers a crafted repository making the agent rewrite workspace settings so that Kiro sent workspace data to an attacker's server. Bulletin 2026-117-AWS (CVE-2026-95985, 24 September) covers the agent's file write tool modifying global configuration paths that Kiro loads automatically. Both start with a developer opening a hostile repository.

What's affected

CVE-2026-95985, Kiro IDE before 1.0.242. Per AWS, the file write tool "may let remote, unauthenticated actors run arbitrary commands and inject crafted instructions into the agent's context." The trigger is running the agent in a crafted repository opened as an untrusted workspace: "sending any message can cause the agent to modify auto-loaded global configuration paths." NVD lists CVSS 4.0 at 8.6 and CVSS 3.1 at 8.8. AWS credits Dinh Ngoc Dung.

CVE-2026-89332, Kiro IDE before 0.8.135. This one targets the Kiro Powers feature. A crafted repository could get the agent to edit the workspace settings file and point the Powers registry URL at an external endpoint. Kiro contacts that URL when the Powers panel opens, and the request carries workspace data. AWS notes a detail worth remembering: Kiro showed the edit for approval, "but the file was already written to disk," so opening the Powers panel before answering the prompt still sent the request. Scored 6.7 (CVSS 4.0).

Neither bulletin lists a workaround.

How to check if you're exposed

1. Check the installed version from Kiro's About dialog. Anything before 1.0.242 is missing the CVE-2026-95985 fix, and anything before 0.8.135 is missing both.

2. Look at the global Kiro directory for entries you didn't create. AWS names the paths: ~/.kiro on macOS and Linux, %USERPROFILE%\.kiro on Windows.

   ls -la ~/.kiro
   find ~/.kiro -type f -mtime -90 -exec ls -l {} \;
   

   Get-ChildItem "$env:USERPROFILE\.kiro" -Recurse -File |
     Sort-Object LastWriteTime -Descending | Select-Object -First 30 FullName, LastWriteTime
   

   Pay attention to recently changed files you don't recognize, especially anything that defines tools, servers, hooks or instructions.

3. For CVE-2026-89332, check repositories you opened in Kiro before 0.8.135 for changes to workspace settings you didn't make:

   git status --short
   git diff --stat
   

   Any modified settings file you didn't edit yourself deserves a closer look, especially one that contains a URL.

4. List third-party repositories opened in Kiro during the exposure window: interview tasks, sample projects, forks and anything cloned from an issue or chat link.

What to do now

1. Upgrade to Kiro IDE 1.0.242 or later. That covers both CVEs.
2. Clean the global config. Remove entries in ~/.kiro you can't explain, then restart Kiro so it reloads a clean state.
3. Rotate credentials for affected projects. For CVE-2026-89332, AWS says to "rotate any credentials present in projects opened on earlier versions." Include .env files, cloud CLI profiles referenced by the project, and tokens in local config.
4. Open unknown repositories as untrusted and don't chat with the agent there until you've read what's in them. CVE-2026-95985 needed only "any message" in an untrusted workspace.
5. Treat agent-writable config as code. Any file the agent can write and the IDE later loads automatically deserves the same review as a script.

Why it matters

Both bugs follow one pattern. The agent can write files, and some of the files it can write are ones the IDE trusts. Once those two sets overlap, a prompt injection becomes persistent configuration, and configuration outlives the session that created it.

The approval detail in CVE-2026-89332 is the sharper lesson. A diff prompt that appears after the write has already happened is a notification, not a control. If anything reads the file between the write and the click, the decision has already been made.

Global configuration raises the stakes further. A change under ~/.kiro doesn't stay in the hostile repository. It follows the developer into every project they open next.

Try it yourself

Make a short list of the AI coding tools installed across your team, and for each one write down its global config directory and whether the agent can write there. That list is the start of an AI bill of materials, and it tells you where to look after the next advisory like this.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• AWS Security Bulletin 2026-117-AWS: CVE-2026-95985
• AWS Security Bulletin 2026-111-AWS: CVE-2026-89332
• NVD: CVE-2026-95985
• NVD: CVE-2026-89332
• Kiro changelog: 1.0.242