Organization

Mindgard

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Aug 28, 2026 · last 18d ago

Timeline1 articles

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Mindgard found a prompt injection flaw in Amazon Kiro IDE letting attacker-controlled workspace files exfiltrate sensitive local data; fixed in version 0.8.140.

Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that lets attacker-controlled repository content steer the agent into exfiltrating sensitive workspace data through Kiro Powers, which bundles MCP server configurations, POWER.md steering files, hooks, and contextual knowledge. Exploitation requires the user to open a malicious project via a workspace file and send any message to the agent; difficulty is rated low and it works in both trusted and untrusted workspaces. Amazon fixed the issue in Kiro IDE 0.8.140; the flaw has no CVE identifier and follows earlier Kiro bugs including CVE-2026-10591, plus related prompt-injection and code-execution issues in Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code.

The Hacker NewsAug 28, 18:35 UTC · 18d agoAI safety & security CVE-2026-10591 CVE-2026-35603 CVE-2026-257251

Related CVEsby mentions

CVE-2026-105918.6<1%
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbi
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
· amazon kiro ide—
CVE-2026-257257.7<1%
Claude Code is an agentic coding tool.
Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was…
· anthropic claude code—
CVE-2026-356035.4<1%
Claude Code is an agentic coding tool.
Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine.…
· anthropic claude code—

Appears with

organization Amazon 1 organization Intezer 1 organization The Hacker News 1 product Claude Code 1 product Cursor 1 product Gemini CLI 1 product GitHub Copilot CLI 1 product Kiro IDE 1 product Kiro Powers 1 product OpenAI Codex CLI 1 vendor Amazon 1 vendor Anthropic 1 vendor GitHub 1 vendor Google 1 vendor Mindgard 1 vendor OpenAI 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.