30
30
30
45
30
45
30
35
30
30
30
30
35
30
30
30
30
Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Mindgard found a prompt injection flaw in Amazon Kiro IDE letting attacker-controlled workspace files exfiltrate sensitive local data; fixed in version 0.8.140.
Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that lets attacker-controlled repository content steer the agent into exfiltrating sensitive workspace data through Kiro Powers, which bundles MCP server configurations, POWER.md steering files, hooks, and contextual knowledge. Exploitation requires the user to open a malicious project via a workspace file and send any message to the agent; difficulty is rated low and it works in both trusted and untrusted workspaces. Amazon fixed the issue in Kiro IDE 0.8.140; the flaw has no CVE identifier and follows earlier Kiro bugs including CVE-2026-10591, plus related prompt-injection and code-execution issues in Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code.
55
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.
42
30
30
30
30
30
30
30
30
30
30
35