python not in trusted commands - kiro pounding on instances with python

[cyclistmass]

Before opening, please confirm:

• I have searched for duplicate or closed issues

Operating System

win32

Kiro Version

0.11.130

Bug Description

It did not do anything unintended but I sure as heck removed python from the path and kiro kept using it.

Steps to Reproduce

Add python to your trusted commands, wait for kiro to use it then remove it from the list, it keeps using it. Traversing ec2 instances is a great way to get kiro into python land.

Expected Behavior

I expect kiro to not use commmands not in it's list at any time.

Conversation ID

920613fe-91f0-4424-929d-047fd4566423
920613fe-91f0-4424-929d-047fd4566423
920613fe-91f0-4424-929d-047fd4566423
920613fe-91f0-4424-929d-047fd4566423
920613fe-91f0-4424-929d-047fd4566423

Additional Context

I was inventorying machines and kiro started doing boto3 instead of ssm and I was not happy with letting it lose with python I could not read first.

[github-actions]

🤖 Potential Duplicate Detected

This issue appears to be similar to:

• #7133: execute_bash got full trust permissions from another tool approval (85% similar)
• #6189: allowedCommands and "Run and Trust" don't match multiline commands (85% similar)
• #6153: Allow env vars in allowedCommands (85% similar)
• #6130: Kiro can get around untrusted command by chaining commands, if it starts with a trusted command (85% similar)
• #5376: Bug Report: execute_bash Tool Blocking All Commands (85% similar)

What happens next?

• ⏰ This issue will be automatically closed in 3 days
• 🏷️ If this is not a duplicate, you can prevent automatic closure by adding a comment or reacting with 👎 to this message.
• 💬 Comment on the original issue if you have additional information

Why is this marked as duplicate?
Both issues describe Kiro continuing to use commands/permissions that should have been revoked - the new issue reports Python continuing to be used after removal from trusted commands, while #7133 reports execute_bash retaining full permissions inappropriately. Both represent the same core security problem of permission persistence.

[cyclistmass]

This is not the same as any of the other bugs this was python was in my trusted commands, kiro went nuts using it unexcpectedly, so I removed it from trusted commands and kiro kept using python.

[github-actions]

Thank you for your feedback! 🙏

The duplicate label has been removed and this issue has been sent back for maintainer review.

A maintainer will review this issue shortly.