When the Machine Reads What It Shouldn’t
A vulnerability in Amazon’s AI coding tool shows why “human in the loop” is a slogan, not a safeguard
Security researchers had a simple test for Kiro, Amazon’s AI-powered coding assistant: point it at a web page containing hidden text, and see what happens. What happened was that the page rewrote Kiro’s own configuration file and launched code of the attacker’s choosing — without a single dialogue box asking the developer for permission. Multiple research teams found variants of the same flaw over the course of a year; the vulnerability that made headlines this July let a poisoned page overwrite Kiro’s MCP configuration file and launch malicious code, bypassing the approval boundary meant to stop risky actions. A routine instruction — summarise this page — became silent code execution on the developer’s machine.
Amazon has patched the specific bug. That is the least interesting part of the story. The more unsettling finding is structural: large language models have no way to separate data from instructions, because for a transformer, data is instructions. Engineers have spent decades building walls between the two — marking memory as non-executable, sanitising database queries. AI agents demolish that wall by design: whatever text they read, they may also obey.
This is not Kiro’s first brush with the problem, nor will it be its last. A researcher flagged an identical configuration-rewrite path on the tool’s launch day in 2025; Amazon’s fix required approval only in one operating mode, leaving the default mode exposed to a near-identical attack the following year. By July 2026, outside researchers had catalogued more than thirty comparable flaws across rival coding tools. The pattern suggests prompt injection is less a bug to be patched than a permanent feature of how these systems work — what one security researcher has called the “lethal trifecta”: an agent that reads untrusted data, holds access to sensitive information, and can take action in the world. Meet all three conditions, and a foothold for mischief usually follows.
The same logic travels well beyond software. Consider a case from Brazil, where two lawyers reportedly buried an instruction to an AI system inside a court filing — white text on a white background, invisible to the judge reading the page but perfectly legible to any language model asked to summarise or process the document. The mechanism is identical to Kiro’s: exploit the fact that a machine reading text has no innate concept of “this part wasn’t meant for you.” Where Kiro’s attacker wanted code execution, the courtroom attacker wanted influence over a legal process. The vulnerability is the same shape wearing different clothes.
What should worry executives is not any single incident but the mismatch between the marketing and the mechanics. AI agents are sold on the promise of a human “in the loop,” reviewing and approving what the machine wants to do. But an approval dialogue is only a safeguard if the human is shown the step that actually matters — and, as Kiro’s history shows, engineering teams keep discovering new steps that quietly bypass the dialogue altogether. The fix that holds, security researchers now argue, is not a smarter model or a better filter but a platform-level constraint: hard limits on what an agent can write to or execute, enforced regardless of what the model has been talked into believing.
For companies racing to deploy AI agents into coding pipelines, legal workflows and customer service, the lesson is unglamorous but urgent: treat every document, web page or filing an AI reads as a potential instruction set, not merely as content. The convenience of an assistant that reads everything comes bundled with a liability — it really does read everything, including the part written in white ink.
About Techvox
Techvox is the English-language technology and AI desk of Swissvox, an independent Swiss media platform funded solely by its readers — free of party affiliation, advertisers, or state support. Techvox covers technology and AI developments with a particular focus on Switzerland and Asia. Readers who want to support independent tech journalism can do so through Techvox’s membership model.