Amazon Kiro, an AI-powered development environment, has been found vulnerable to a prompt injection attack that could allow sensitive local data to be sent to an external server. Researchers at Mindgard discovered the issue in Kiro IDE version 0.7.45 on Windows. The vulnerability did not have a CVE identifier at the time of reporting. Amazon has since released a fix in Kiro IDE version 0.8.140.
The attack uses malicious content placed inside a project repository to influence the Kiro AI agent. A victim only needs to open a specially prepared workspace and interact with the agent. Researchers found that the attack could work without the user directly entering a malicious prompt. They reproduced the issue in both trusted and untrusted workspaces.
Kiro Powers played an important role in the attack because they can connect MCP server configurations, steering files, hooks and other information. The researchers showed that malicious instructions could make Kiro read sensitive local information and place it inside a configuration URL. The Kiro Powers process could then request that attacker-controlled URL. This created a path for the information to leave the local environment.
For the proof of concept, researchers used a test repository containing a sanitized API key inside an .env file. Malicious project instructions told Kiro to find the value and modify the workspace configuration. The agent then triggered the Kiro Powers process using the changed setting. As a result, the test secret appeared in an outgoing request to the researchers’ controlled server.
The researchers said the main problem comes from several legitimate Kiro features working together in an unsafe way. Project files can influence the AI agent, while the agent can read files and change configuration. Another Kiro feature can then use that configuration to make a network request. This combination allows attacker-controlled project content to influence an action that can send information outside the workspace.
Amazon addressed the reported issue in Kiro IDE version 0.8.140 following responsible disclosure by Mindgard. The incident highlights a wider security challenge for AI development tools that can access files, tools and system resources. Security researchers say these environments need testing across complete attack paths, not just individual features. As AI agents gain more capabilities, protecting sensitive data from indirect prompt injection attacks will become increasingly important.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
