Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

What it is

A prompt-injection–driven data exfiltration flaw in Amazon Kiro, Amazon's agentic AI IDE, disclosed by Mindgard. It has no CVE identifier and was confirmed against Kiro IDE 0.7.45 on Windows. Attacker-controlled repository content is interpreted as instructions and made to influence security-sensitive operations, ultimately causing local data to be sent to an external endpoint. Amazon fixed it in Kiro IDE 0.8.140 (shipped in the January 15 update); current latest is 1.0.337.

How it works

The abuse rides "Kiro Powers," which bundle MCP server configs, steering files (POWER.md), hooks, and contextual knowledge. The steering file acts as an "onboarding manual" telling the agent which MCP tools exist and when to use them. The trust-boundary failure spans the whole chain rather than one bug: repository content influences the agent → the agent reads sensitive local files → the agent writes that data into security-relevant IDE configuration → a later IDE capability turns that modified config into network activity. It builds on a prior Mindgard finding where a steering file coerced the agent into embedding local file contents in a Markdown image request to reach an external server.

flowchart LR
  A[Malicious workspace file opened] --> B[User sends any message]
  B --> C[Repo content read as instructions]
  C --> D[Agent reads sensitive local files]
  D --> E[Writes data into IDE config]
  E --> F[IDE capability triggers network exfil]

Preconditions / Affected

Two user actions required, both mundane: the victim must open the project via File → Open Workspace From File (not by opening the folder directly), then send any message to the agent. The user need not submit a malicious prompt or reference the attacker content. Reproducible against both trusted and untrusted workspaces; exploitation difficulty rated low.

What to do

Update to Kiro IDE 0.8.140 or later. Note the interaction pattern for detection/training: opening a workspace-file rather than a folder is the trigger vector here.

Caveats

Distinct from Kiro's earlier CVE-2026-10591 (CVSS 8.8), an insufficient-access-control flaw where hidden web-page instructions let Kiro rewrite its own .vscode/tasks.json or ~/.kiro/settings/mcp.json for arbitrary code execution on folder open. The current flaw is the prompt-injection exfiltration chain, not that one. Mindgard's broader point: these AI-tool defects emerge from interactions among model interpretation, app logic, tools, config, and external resources, and don't map cleanly onto disclosure processes built for well-defined software bugs.