AWS’s security bulletin is unusually blunt about the order of events. In Kiro IDE versions before 0.8.135, an agent could write a crafted workspace setting in an untrusted repository. Kiro showed that edit and its external URL in a pending approval, but the setting was already on disk. If the developer opened Kiro’s Powers panel before answering the prompt, the panel could fetch an attacker-controlled registry and send potentially sensitive workspace data to it.
That sequence is the story behind CVE-2026-89332, published by AWS on September 11 as an “Important” bulletin. AWS says there is no workaround: update to 0.8.135 or newer, and rotate credentials that were present in a project opened on an earlier release.
The headline should not be “don’t use supervised mode.” A visible diff still has genuine value for code review and recovery. The narrower, more important conclusion is that a diff cannot serve as the complete boundary when another component can consume a changed file before the user accepts or rejects it.
The risky handoff happened between write and review
AWS describes a chain with four pieces: an untrusted repository, an agent capable of altering workspace settings, a registry URL used by Powers, and a user action that opens that panel. The repository content steers the agent toward a configuration change; the agent writes the setting; the IDE presents a review card; then a separate feature reads the now-live configuration and makes a request.
That last transition matters. Developers often read “approval required” as “nothing has changed yet.” Kiro’s own current documentation draws a finer distinction. It says its Autopilot and Supervised modes have the same underlying capabilities to read and write files and run commands; Supervised changes the review workflow, rather than the access scope. It also says writes occur during tool execution, are tagged for review, and are reverted if rejected after the turn.
That behavior is workable for ordinary source edits. It becomes a security problem when a configuration file is also an instruction to an IDE feature that has network access. The approval was real, but it arrived after a relevant side effect had become possible.
| Stage | Observed or documented behavior | Security implication |
|---|---|---|
| Agent edit | AWS says a crafted repository could lead the agent to modify workspace settings. | Repository content can influence host-side configuration. |
| Supervised review | Kiro documents that writes occur during execution and are then tagged for review. | A review card is not necessarily a pre-write gate. |
| Powers panel | AWS says opening it could fetch the changed registry URL before the prompt was resolved. | Another feature can turn a file write into network egress. |
| Remediation | AWS fixed the issue in 0.8.135 and later; it recommends upgrade and credential rotation. | Treat earlier project openings as a possible credential-exposure event. |
Sources: AWS’s security bulletin and Kiro’s privacy and security documentation. The security implications are AI News Fab analysis.
Who should act now
First, inventory the installed Kiro version—not merely the version an employee believes they have. Kiro’s public changelog is now on a 1.0.x line, including version 1.0.437 on September 1, so managed fleets should verify both the local binary and rollout status. The specific affected range in AWS’s advisory is below 0.8.135.
Second, identify projects opened with an affected version. AWS’s rotation advice is conditional and concrete: rotate credentials that were present in those projects. That can include cloud access keys, personal access tokens, repository credentials, package-registry tokens, signing materials and application secrets reachable from the workspace or environment. Rotation is not a claim that every affected session was compromised; it is the prudent response when exposure cannot be ruled out from a local history alone.
Third, review more than the code diff. Check workspace settings, Power registries, MCP configuration, hooks, trusted commands, extensions and other files that an IDE or agent may consume. For higher-risk repositories, block unnecessary outbound connections and use a separate account or container with only short-lived, narrowly scoped credentials.
Kiro’s security guidance supports much of that operating model. It recommends workspace isolation, a clean environment, temporary or named AWS credentials and tighter repository access. It also says Supervised mode does not restrict which files the agent can read, which commands it can suggest or its network access. Those are useful safeguards, but they are compensating controls, not evidence that a review pane itself contains authority.
The counterargument is real, but limited
This was not a one-click remote takeover of every Kiro installation. The reported flow depended on an affected version, an untrusted workspace, agent-driven configuration modification and the user opening Powers before resolving the pending change. The vendor has issued a fix, and AWS recommends it rather than a disruptive product shutdown. Teams running current software, isolated workspaces and least-privilege temporary credentials substantially reduce the relevant exposure.
Still, that does not rescue the old mental model. Security programs cannot base their control design on the assumption that a human can review a diff before every meaningful side effect. The larger agent-IDE category is converging on configurations that can load extensions, contact registries, run hooks, invoke MCP servers or guide command execution. In that environment, repository content must be treated as data—not as authority over what the host should fetch or execute.
The unanswered question is how the fixed architecture handles configuration-derived actions before review state exists. AWS’s public bulletin does not detail that implementation, nor does it say how many developers opened affected projects or whether exploitation occurred in the wild. Those omissions should keep incident responders factual: assess the specific machines and credentials at hand instead of inventing prevalence.
For developers using Kiro only for a local, credential-free refactor in a trusted repository, the operational burden may not justify a full forensic exercise. For platform teams, contractors and anyone opening public or third-party code beside production-capable identities, it does. Upgrade, rotate the secrets that mattered, and redesign the pilot so an unreviewed configuration cannot quietly become a network instruction.
Related reading: AI News Fab coverage of AI-agent infrastructure