Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

[XploitLK-Bot]

Researchers from Mindgard have detailed a prompt injection vulnerability in Amazon Kiro, an AI-powered, agentic integrated development environment (IDE). The issue could allow an attacker to exfiltrate sensitive data by leveraging the tool's "Kiro Powers" feature.

The flaw, which currently has no CVE identifier assigned, affects Kiro IDE version 0.7.45 on Windows. It was disclosed without a patch being immediately available.

• Affected product: Amazon Kiro IDE 0.7.45
• Platform: Windows
• Attack vector: Prompt injection via malicious content processed by Kiro Powers
• Impact: Potential exfiltration of sensitive project data or credentials

The attack works by crafting a malicious prompt or injecting instructions into content that the IDE processes. When Kiro Powers acts on the injected instructions, it can be manipulated into sending data to an attacker-controlled endpoint. This is particularly concerning because agentic IDEs have access to source code, environment variables, and other development secrets.

Given that Kiro is designed to operate with high-level autonomy, the research highlights a broader risk: the more permissions an AI assistant has, the more damage a successful prompt injection can cause. Organizations using agentic coding tools should review how they sandbox AI-driven actions and monitor for unusual outbound network requests.

Source: The Hacker News

Are you currently using Amazon Kiro or similar agentic IDEs in your development workflow, and how are you restricting their network access to mitigate this type of risk?