Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers.
The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard. The latest version of the IDE is 1.0.337.
“The issue allowed attacker-controlled repository content to influence the Kiro agent and ultimately cause sensitive local information to be transmitted to an external endpoint,” security researcher Fergal Glynn said in a report shared with The Hacker News.
Kiro Powers goes beyond skills by bundling Model Context Protocol (MCP) server configurations, steering files (“POWER.md”), hooks, and contextual knowledge. The steering file is like an “onboarding manual” that provides persistent context and tells the AI agent what MCP tools are available and when to use them.
According to Mindguard, successful exploitation requires two user actions: the user has to open the malicious project through a workspace file using File → Open Workspace From File rather than opening the folder directly and then send a message to the agent. The vulnerability is reproducible against both trusted and untrusted workspaces.
Once these conditions are satisfied, sensitive workspace data can be exfiltrated to the attacker “without the user explicitly requesting that Kiro access or transmit” it. The exploitation difficulty has been assessed as low.
What makes this flaw notable is that the user does not have to submit a malicious prompt or reference the attacker-controlled content. Once the crafted workspace file is opened, sending any message is enough to trigger the vulnerable flow.
“The vulnerability appears when attacker-controlled project content is interpreted as instructions, and those instructions are allowed to influence security-sensitive operations elsewhere in the IDE,” Mindguard said.
“The trust boundary failure occurs across the entire sequence. Repository-controlled content influences the agent, the agent reads sensitive local information, the agent writes that information into security-relevant IDE configuration, and a subsequent IDE capability turns the modified configuration into network activity.”
As AI development environments increasingly bring interpretation and execution together within the same workflow, repository files can be used to provide context to a model, while the agent can read files, invoke tools, and activate other functionality in the application, potentially leading to trust boundary failures.
Following responsible disclosure, a fix for the flaw was implemented by Amazon in Kiro IDE version 0.8.140. The vulnerability also builds upon a previous bug highlighted by Mindguard that allowed steering-file directives to cause local information to be incorporated into a Markdown image request and transmitted to an external server.
“By carefully crafting a steering file to read a local file and render a Markdown image, an attacker can coerce the AI to send sensitive data to an external server,” Mindguard noted at the time.
This is not the first time vulnerabilities have been disclosed in Kiro. In June 2026, Amazon addressed an insufficient access control flaw (CVE-2026-10591, CVSS score: 8.8) that could have enabled a remote unauthenticated actor to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths, such as “.vscode/tasks.json” or “~/.kiro/settings/mcp.json,” and facilitate auto-execution on folder open.
“By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer’s machine,” Intezer said. “No suspicious approval prompt is ever shown to the user. All the developer asked Kiro to do was perform a legitimate action.”
The findings also come against the backdrop of a number of security issues discovered in AI tools –
- A vulnerability chain in OpenAI Codex CLI for Windows that abuses prompt injection through web.run to turn a routine web search into covert host-level command execution outside the built-in sandbox feature
- A zero-click remote code execution vulnerability in Cursor CLI that uses indirect prompt injection to write a malicious executable to the workspace and execute it
- An arbitrary code execution vulnerability in Cursor, GitHub Copilot CLI, Google Gemini CLI, and the Codex app for Windows stemming from search order hijacking that allows an attacker to place a malicious binary with the same name as an external dependency (e.g., “git.exe” and “which.exe”) in the current working directory before trusted system paths
- A vulnerability impacting Anthropic Claude Code (CVE-2026-35603), Cursor, Codex CLI, and Google Gemini CLI that takes advantage a Windows folder trusted by these tools (“C:\ProgramData\
“) to drop a configuration file (“managed-settings.json,” “hooks.json,” “system-defaults.json,” and “config.toml”) and allow a low-privileged attacker to have their commands executed inside the session of any other user on the machine without any prompt, warning, or elevated access - A sandbox escape vulnerability in Claude Code (CVE-2026-25725, CVSS score: 7.7) that allows an attacker with code execution inside the sandbox to create a malicious “.claude/settings.json” file containing a hook with arbitrary commands that’s executed on the underlying host when a subsequent run of Claude Code
- A set of vulnerabilities in Gemini CLI that allow a sandboxed attacker to escape the container boundary and run arbitrary code on the host system, as well as enable theft of the user’s Google OAuth token
- A vulnerability in Codex CLI‘s sandbox that causes the trust boundary to collapse through an LLM tool call to “apply_patch,” which is permitted to create and modify files in the .codex directory of the work folder, via direct or indirect prompt injection and achieve command execution on the host
- A vulnerability in NVIDIA NemoClaw (CVE-2026-65105, CVSS score: 8.1) that can allow an attacker to gain control of the local Ollama model server through a single visit to an attacker-controlled web page on the victim’s machine and plant hidden instructions inside the model’s chat template so that they are applied to every subsequent conversation
- A vulnerability in OpenClaw that allows any website to take full control of a developer’s AI agent with no plugins, extensions, or user interaction required by abusing the gateway’s ability to accept connections from localhost through a WebSocket and any website can open a WebSocket connection to localhost
- A vulnerability in Microsoft Visual Studio Code’s MCP install dialog (CVE-2026-41613, CVSS score: 8.8, aka Envade) that, with a single click on a crafted deeplink, enables full code execution on a developer’s system or route MCP tool calls through an attacker’s account
- A vulnerability in Claude Desktop called PromptFiction that, with a single click on a crafted link, could trick the AI agent to perform unintended actions, including harvesting sensitive data or running arbitrary code
“The Kiro findings expose a problem that extends beyond one IDE or one disclosure program,” Mindguard said. “AI vulnerabilities can emerge from interactions between model interpretation, application logic, tools, configuration, and external resources, making them difficult to evaluate using disclosure processes designed around more clearly defined software defects.”
“As AI systems gain more tools and interact with more application state, vulnerability disclosure programs need to evaluate execution paths at the same level of detail as the researchers discovering them.”