Putting an AI assistant in a messaging app makes delegation feel effortless. That convenience depends on a less visible distinction: being able to contact an assistant should not automatically mean being able to direct its work. An authorization flaw disclosed by AWS on October 20, Pacific Daylight Time, brings that distinction into focus.
Kiro Crew can receive work through messaging channels and delegate tasks to subagents on the operator’s machine. Under certain WhatsApp configurations, a group member could send instructions to a subagent running in another session. Those instructions ran under that session’s approval policy, while the audit trail attributed the activity to the person running Kiro Crew instead of the sender. The affected software is Kiro Crew, and the flaw lies in its authorization checks.
Tracked as CVE-2026-112380, the flaw affects versions from 0.4.0 up to, but not including, 0.7.2. Exposure requires the WhatsApp channel and non-default settings, such as adding a permitted group or opening the direct-message policy. The default combination of no listed groups and a self-only DM policy is unaffected.
The patch predates the announcement. Version 0.7.2 was released on September 29. The fix tightened admission for group senders and added identity and ownership checks to subagent controls. Operators using the affected features should move to a patched release. Until then, disabling the WhatsApp channel is an available workaround, as is clearing the group list while keeping the DM policy set to self.
For agent developers, the broader lesson is easy to overlook when an assistant works smoothly. People may be happy to include an assistant in a group conversation without giving every participant access to their computer. Delegating a task should preserve that boundary. A request needs to retain its sender’s identity as it moves between conversations and agents, so permission decisions remain meaningful. Better language understanding cannot substitute for that engineering work.
Sources checked: October 21, 2026