Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
15:39 · August 27, 2026 · Hacker News AI Section
Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard. The latest version of
Summary
Amazon Kiro is an agentic integrated development environment that combines large-language-model interpretation with direct access to files, tools, and configuration. Researchers at Mindguard identified a prompt-injection issue in version 0.7.45 on Windows that lets attacker-controlled repository content steer the agent into reading local workspace data and exfiltrating it to an external endpoint. The attack chain relies on Kiro Powers, a feature that packages Model Context Protocol server definitions, steering files named POWER.md, hooks, and persistent context; once a malicious workspace file is opened through the “Open Workspace From File” dialog, any subsequent message to the agent is sufficient to trigger the flow without further user intent.
The root cause is a trust-boundary failure: repository-controlled instructions are treated as authoritative directives that can influence security-sensitive operations elsewhere in the IDE. The agent may read sensitive files, write their contents into configuration locations that control network activity, and thereby cause an outbound transmission. Exploitation does not require the developer to reference the attacker content or issue a malicious prompt, and the flaw is reproducible in both trusted and untrusted workspaces. Difficulty is rated low.
The same research group previously demonstrated a related steering-file technique that coerced the model into embedding local-file contents inside a Markdown image reference, again resulting in external transmission. Amazon addressed the newer issue in version 0.8.140. An earlier, separate vulnerability (CVE-2026-10591) had allowed crafted instructions to rewrite execution-sensitive paths such as tasks.json or mcp.json, enabling arbitrary command execution on folder open.
Mindguard notes that these findings illustrate a broader challenge for AI tooling: when interpretation and execution are tightly coupled, traditional vulnerability-disclosure processes struggle to evaluate the full execution path that spans model output, application logic, and external resources.
Why it matters
Directly addresses AI security risks like prompt injection and data exfiltration in development environments, actionable for Dutch security teams using or auditing AI IDEs. Highlights privacy implications through unauthorized data transmission and EU-relevant concerns around AI tool trust boundaries.
