Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Mindgard found a prompt injection flaw in Amazon Kiro IDE letting attacker-controlled workspace files exfiltrate sensitive local data; fixed in version 0.8.140.
Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that lets attacker-controlled repository content steer the agent into exfiltrating sensitive workspace data through Kiro Powers, which bundles MCP server configurations, POWER.md steering files, hooks, and contextual knowledge. Exploitation requires the user to open a malicious project via a workspace file and send any message to the agent; difficulty is rated low and it works in both trusted and untrusted workspaces. Amazon fixed the issue in Kiro IDE 0.8.140; the flaw has no CVE identifier and follows earlier Kiro bugs including CVE-2026-10591, plus related prompt-injection and code-execution issues in Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code.
- Kiro Powers bundles MCP server configs, POWER.md steering files, hooks, and knowledge
- Repository content is interpreted as instructions, influencing security-sensitive IDE operations
- Steering-file directives can coerce the agent to send local data via Markdown image requests
- Related 2026 flaws hit Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code
- Organizations
- MindgardAmazonIntezerThe Hacker News
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10591 | Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute… | 8.6 | <1% | ||
| CVE-2026-25725 | Claude Code: Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did… | 7.7 | <1% | ||
| CVE-2026-35603 | Claude Code: Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating… | 5.4 | <1% |
From the original article
5 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0. 7.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.