Full Report
Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard. The latest version of
Analysis Summary
# Vulnerability: Amazon Kiro IDE Data Exfiltration via Prompt Injection
## CVE Details
- **CVE ID**: N/A (No identifier assigned for this specific flaw)
- **CVSS Score**: Not specifically rated (Related CVE-2026-10591 carries a score of 8.8)
- **CWE**: Trust Boundary Violation / Input Validation (Indirect Prompt Injection)
## Affected Systems
- **Products**: Amazon Kiro IDE (AI-powered integrated development environment)
- **Versions**: Version 0.7.45 and earlier (up to 0.8.140)
- **Configurations**: Windows-based installations; systems where "Kiro Powers" and Model Context Protocol (MCP) are active.
## Vulnerability Description
The vulnerability stems from a trust boundary failure where attacker-controlled repository content (such as steering files like "POWER.md") can influence the AI agent's behavior. When a malicious workspace is opened, the IDE interprets instructions within the project files as persistent context. This allows an attacker to coerce the AI agent into reading sensitive local files and transmitting that data to an external endpoint by modifying security-sensitive configurations or embedding data into Markdown image requests.
## Exploitation
- **Status**: PoC available / Disclosed by Mindgard researchers.
- **Complexity**: Low (requires minimal user interaction).
- **Attack Vector**: Local/Network (via malicious repository/workspace file).
- **Trigger**: The user must open a malicious workspace file (File → Open Workspace From File) and send any message to the agent. No specific malicious prompt from the user is required.
## Impact
- **Confidentiality**: High (Sensitive workspace data and local files can be exfiltrated).
- **Integrity**: Medium (Attacker can influence agent behavior and modify local IDE configurations).
- **Availability**: Low (Primary impact is data theft).
## Remediation
### Patches
- **Amazon Kiro IDE 0.8.140**: This version contains the fix for the reported data exfiltration flaw.
- **Amazon Kiro IDE 1.0.337**: The current latest stable version.
### Workarounds
- Avoid opening workspace files from untrusted sources or unknown repositories.
- Use the "Open Folder" method rather than "Open Workspace From File" when inspecting suspicious projects.
- Audit `POWER.md` and `.kiro/settings/mcp.json` files in new repositories before interacting with the AI agent.
## Detection
- **Indicators of Compromise**:
- Presence of unexpected `POWER.md` files containing instructions to read local system files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, or environment variables).
- Outbound network requests to unknown external domains triggered by the IDE (specifically via Markdown image rendering).
- **Detection methods**: Monitor for modifications to `mcp.json` or `.vscode/tasks.json` by the IDE agent process.
## References
- **Vendor Advisory**: hxxps[://]kiro[.]dev/changelog/ide/
- **Research Report**: hxxps[://]mindgard[.]ai/blog/amazon-kiro-data-exfiltration
- **Related Vulnerability**: hxxps[://]aws[.]amazon[.]com/security/security-bulletins/2026-037-aws/
- **Technical Analysis**: hxxps[://]thehackernews[.]com/2026/08/amazon-kiro-prompt-injection-can.html