AWS discloses Kiro Crew vulnerability: WhatsApp group members can manipulate another session's sub-agent to execute commands
AWS disclosed an authorization vulnerability, CVE-2026-112380, in the open-source personal AI agent Kiro Crew. Affected versions are 0.4.0 and later, and before 0.7.2; it has been fixed in 0.7.2. The agent can be accessed from a web panel, CLI, or messaging channels such as WhatsApp, and runs tools on the operator's machine; under configurations where a WhatsApp group is added to the allowlist, or the direct message policy is set to open, group members can send instructions to another session's sub-agent, and the sub-agent executes them on the operator's machine according to that session's approval policy, with audit records attributed to the operator rather than the actual sender. AWS says the default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, and groups not listed are dropped before dispatch. Mitigations are to clear whatsapp.groups, keep dm_policy as self, or disable the WhatsApp channel before upgrading.
The advisory states that the default configuration is not affected, and gives configuration adjustments that close the entry point without upgrading, so teams deploying this agent can use them to self-check their exposure surface.