Amazon Kiro Prompt Injection Vulnerability Enables Data Exfiltration via Kiro Powers

Cybersecurity researchers at Mindguard have disclosed a prompt injection vulnerability in Amazon Kiro, an AI-powered agentic integrated development environment (IDE), that could allow attackers to exfiltrate sensitive local data through Kiro Powers. The flaw, which lacks a CVE identifier, affects Kiro IDE version 0.7.45 on Windows; the latest version is 1.0.337. Successful exploitation requires the user to open a malicious workspace file via File → Open Workspace From File and then send any message to the agent. Once triggered, the attacker-controlled repository content influences the Kiro agent to read sensitive local information and transmit it to an external endpoint without explicit user request. The exploitation difficulty is assessed as low. The vulnerability stems from a trust boundary failure where repository-controlled content is interpreted as instructions, affecting security-sensitive operations. Amazon addressed the issue in Kiro IDE version 0.8.140. This disclosure follows a previous Mindguard finding involving steering-file directives that could leak local data via Markdown image requests. The article also highlights related vulnerabilities in other AI coding tools, including CVE-2026-10591 in Kiro, CVE-2026-35603 in Claude Code, CVE-2026-25725 in Claude Code, CVE-2026-65105 in NVIDIA NemoClaw, and CVE-2026-41613 in Microsoft Visual Studio Code, underscoring broader security challenges in AI development environments.