Vulnerability in Amazon's Kiro AI Editor Allows Data Theft via Prompt Injection

Mindguard has disclosed the details of a vulnerability in Amazon Kiro, an agentic development environment powered by artificial intelligence. The flaw, which has not yet been assigned a CVE identifier, was reproduced in Kiro IDE version 0.7.45 for Windows (the current version at the time of publication being 1.0.337). Amazon has already closed the issue in build 0.8.140.

How the attack works

The crux of it is that the contents of an attacker-controlled repository are interpreted by the agent as instructions. The key role is played by the Kiro Powers mechanism, which — beyond ordinary skills — pulls in MCP server configurations, hooks, contextual knowledge, and so-called “steering” POWER.md files. Such a file works like a “beginner's cheat sheet”: it tells the AI agent which tools are available and when to use them.

Successful exploitation requires just two actions from the victim: opening the malicious project specifically through the workspace file (File → Open Workspace From File, rather than opening a folder) and then sending the agent any message. The attack works in both trusted and untrusted workspaces, and its complexity is rated as low.

What is especially alarming is that the user need neither write a malicious query nor reference any suspicious content. It is enough to open the prepared workspace file — and the very first message sets off a chain at the end of which confidential local data is sent to an external server.

The collapse of trust boundaries

Researcher Fergal Glynn describes the mechanism as a sequential collapse of trust boundaries: the repository's contents influence the agent, the agent reads local data, writes it into a sensitive IDE configuration, and a subsequent feature of the environment turns the modified config into network activity. The vulnerability builds on an earlier Mindguard trick in which a steering file forced the AI to insert local data into a Markdown image request, thereby sending it outward.

This is not Kiro's first problem. In June 2026, Amazon fixed an improper access control flaw (CVE-2026-10591, CVSS 8.8): hidden instructions on a web page could force the editor to rewrite its own MCP configuration file and achieve arbitrary code execution — without a single warning.

The problem is bigger than one editor

Stories like this are multiplying: prompt injection and sandbox escapes have been found in OpenAI Codex CLI, Cursor, GitHub Copilot CLI, Google Gemini CLI, Claude Code, NVIDIA NemoClaw, and other tools. Mindguard emphasizes the main takeaway: AI vulnerabilities arise at the intersection of model interpretation, application logic, tools, configurations, and external resources. Assessing them with the familiar disclosure procedures designed for classic software defects simply does not work — bug bounty programs will have to trace execution paths with the same thoroughness as the researchers themselves.

Source: The Hacker News