Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
- ID
- 18677
- Status
- summarized
- Published
- 27 Aug 2026, 9:39 PM
- Fetched
- 28 Aug 2026, 5:26 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 28 Aug 2026, 5:26 PM
- Tags
- Audience
- developersai_agent_usersai_ml_learners
What happened
Mindguard disclosed a prompt injection vulnerability in Amazon Kiro IDE (version 0.7.45 on Windows) that lets attacker-controlled repository content exfiltrate sensitive local data via Kiro Powers. Exploitation requires the user to open a malicious project via File → Open Workspace From File and then send any message to the agent—no malicious prompt needed. The latest IDE version is 1.0.337, and no CVE has been assigned.
Why it matters
If you or your team use Amazon Kiro, update to 1.0.337 immediately and stop opening workspace files from untrusted repos via File → Open Workspace From File. The attack chain is notable because it requires no crafted prompt—just opening the workspace and sending any message triggers exfiltration through Kiro Powers' MCP server configs and steering files.
Discussion angle
This is a concrete example of how agentic IDEs that auto-load MCP configs and steering files from repo content create a trust boundary problem—discuss whether your team's AI coding tools have equivalent risks and what review process you apply before opening third-party projects.