Amazon Kiro: a prompt injection exfiltrates data from the workspace with a single message

# Amazon Kiro: a prompt injection exfiltrates data from the workspace with a single message

## Mindguard discovers a flaw in Kiro Powers

On August 27, 2026, researchers at Mindguard disclosed details of a vulnerability in Amazon Kiro, the agentic integrated development environment based on artificial intelligence. The flaw allows exfiltration of sensitive data from a developer's workspace by exploiting the Kiro Powers feature and a prompt injection technique. No CVE identifier has been assigned.

Researcher Fergal Glynn explained that the issue allows repository content controlled by an attacker to influence the Kiro agent and cause it to transmit local sensitive information to an external endpoint. The vulnerability affects Kiro IDE version 0.7.45 on Windows; the latest IDE version at the time of reporting was 1.0.337.

## The technical chain: from Kiro Powers to exfiltration

Kiro Powers extends skills by aggregating Model Context Protocol (MCP) server configurations, steer files named "POWER.md", hooks, and contextual knowledge. The steer file acts as an onboarding manual: it provides persistent context and tells the agent which MCP tools are available and when to use them.

Exploitation requires two actions. First, the user must open the malicious project via a workspace file using File → Open Workspace From File, instead of opening the folder directly. Then they must send a message to the agent.

The vulnerability is reproducible with both trusted and untrusted workspaces. Once these conditions are met, sensitive workspace data can be exfiltrated to the attacker without the user explicitly requesting Kiro to access or transmit them. Exploitation difficulty has been assessed as low.

The distinctive aspect: the user does not need to send a malicious prompt. After opening the prepared workspace file, any message is enough to trigger the vulnerable flow.

The trust boundary is crossed in a sequence. Project content controlled by the attacker is interpreted as instructions; the agent reads local sensitive information; the agent writes that information into IDE configurations relevant to security; a subsequent IDE capability turns the modified configuration into network activity. With the increasing integration between interpretation and execution, repository files can provide context to the model while the agent reads files, invokes tools, and activates other features, creating possible trust boundary violations.

## Affected versions and fix

The flaw was demonstrated on Kiro IDE 0.7.45 for Windows. At the time of reporting, the latest version was 1.0.337, but it is not known if that version was also vulnerable.

After responsible disclosure, Amazon implemented a fix in Kiro IDE version 0.8.140. Updating to this version or a later one mitigates the issue. No CVSS score is available for this specific flaw.

## Precedents in Kiro and the KEV catalog

This is not the first vulnerability discovered in Kiro. In June 2026, Amazon fixed an insufficient access control flaw identified as CVE-2026-10591, with a CVSS score of 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). That issue could allow a remote unauthenticated actor to execute arbitrary commands via crafted instructions that caused writes to execution-sensitive paths, such as ".vscode/tasks.json" or "~/.kiro/settings/mcp.json", and facilitated automatic execution upon folder open. According to Intezer, by embedding hidden instructions in a web page read by Kiro, an attacker could make Kiro rewrite its own MCP server configuration file and achieve arbitrary code execution on the developer's machine, without suspicious approval prompts.

The new flaw builds on a previous bug reported by Mindguard, which allowed steer file directives to embed local information into a Markdown image request and transmit it to an external server.

The newly disclosed vulnerability is not listed in CISA's KEV catalog. However, in the last 90 days, other vulnerabilities related to vendors like Amazon, Anthropic, and Microsoft have been added to the catalog: CVE-2019-1068 (August 26), CVE-2026-33824 and CVE-2026-55040 (August 18), CVE-2026-68820 (August 11), CVE-2026-50522 (July 22), and CVE-2026-58644 (July 16). This indicates that the AI tooling ecosystem is under observation for active exploitation.

## An AI ecosystem under pressure

The discovery in Kiro is part of a series of security issues that have emerged in recent months in AI-powered developer tools. Among the most notable episodes: a vulnerability chain in OpenAI Codex CLI for Windows that exploits prompt injection via web.run to turn a web search into covert command execution; a zero-click remote execution vulnerability in Cursor CLI that uses indirect prompt injection to write and execute a malicious executable; an arbitrary code execution vulnerability in Cursor, GitHub Copilot CLI, Google Gemini CLI, and the Codex app for Windows due to binary search order hijacking; and a vulnerability affecting Anthropic Claude Code (CVE-2026-35603, CVSS 7.3) and other tools that exploits a Windows folder considered trusted to drop malicious configuration files.

Also in the mix: a sandbox escape vulnerability in Claude Code (CVE-2026-25725, CVSS 10) that allows a sandboxed attacker to execute commands on the host; a set of vulnerabilities in Gemini CLI enabling container escape and OAuth token theft; and a vulnerability in NVIDIA NemoClaw (CVE-2026-65105, CVSS 8.1) that allows control of the Ollama server with a single visit to a web page. Additionally, OpenClaw can be controlled by any website via WebSocket on localhost, and Microsoft Visual Studio Code fixed the Envade vulnerability (CVE-2026-41613, CVSS 8.8) that allows code execution with a single click on a deep link.

## The lesson from Mindguard: evaluate execution paths

Mindguard concludes that the findings on Kiro highlight a problem that goes beyond a single IDE or a single disclosure program. AI vulnerabilities can emerge from interactions between model interpretation, application logic, tools, configuration, and external resources, making them difficult to assess with disclosure processes designed for more clearly defined software flaws. As the tools available to AI systems increase and interactions with application state grow, disclosure programs must evaluate execution paths with the same level of detail as the researchers who discover them.

For developers using Amazon Kiro, the immediate recommendation is to update to version 0.8.140 or later. While waiting for the update, avoid opening workspace files from untrusted sources and be cautious with suspicious repositories.