Amazon Kiro — Prompt Injection and Sensitive Data Exfiltration via Kiro Powers (No CVE / Multiple Associated CVEs)

Publication date: August 27, 2026
Category: Threat Intelligence / AI Vulnerabilities

Introduction

Cybersecurity researchers have disclosed technical details regarding a critical vulnerability affecting Amazon Kiro, an artificial intelligence (AI)-powered agentic integrated development environment (IDE). The security flaw facilitates the exfiltration of sensitive local information through an attack chain combining prompt injection and Kiro Powers. This architectural weakness highlights emerging security risks at the intersection of large language model (LLM) interpretation, automated tool execution, and configuration state manipulation within modern AI-assisted development applications.

What is Kiro Powers and Prompt Injection? (General Analysis)

Kiro Powers extends beyond basic agent skills by bundling Model Context Protocol (MCP) server configurations, steering files (such as POWER.md), hooks, and contextual knowledge. The steering file functions as an onboarding manual that provides persistent context to the AI agent, specifying which MCP tools are available and when to invoke them.

The vulnerability discovered by Mindgard stems from a trust boundary failure. When an attacker-controlled repository is interpreted by the agent, hidden malicious instructions coerce the agent into reading sensitive local data, writing that data into IDE configuration files, and triggering network operations that transmit the information to an external server.

CVE / IdentifierCategory (CWE)ImpactCVSSVector (summary)
No CVE assigned (Amazon Kiro IDE)CWE-732 (Incorrect Access Control / Trust Boundary Failure)High8.0 (Reasoned estimation)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVE-2026-10591 (Amazon Kiro IDE)CWE-732 (Incorrect Access Control)Critical8.6 (Confirmed NVD)AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE-2026-35603 (Claude Code)CWE-426 (Untrusted Search Path)Medium5.4 (Confirmed NVD)AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE-2026-25725 (Claude Code)CWE-501, CWE-668 (Sandbox Flaw / Access Control)High7.7 (Confirmed NVD)AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE-2026-65105 (NVIDIA NemoClaw)CWE-306 (Missing Authentication for Critical Function)High8.1 (Confirmed NVD)AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVE-2026-41613 (Visual Studio Code MCP)CWE-78, CWE-384 (Session Fixation / Command Injection)High8.8 (Confirmed NVD)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

How Does It Work? (Technical Analysis)

Exploitation requires specific user interaction conditions, although the overall technical difficulty is assessed as low due to the automated workflow of the AI agent:

  • Entry Vector: The user must open a malicious project workspace file using the File → Open Workspace From File command (rather than opening the folder directly). This is reproducible across both trusted and untrusted workspaces.
  • Induced Activation: Unlike classic prompt injection attacks, the user is not required to submit an explicit malicious prompt; sending any casual message to the agent after opening the workspace is sufficient to trigger the vulnerable execution flow.
  • Configuration Manipulation & Exfiltration: Repository-controlled content is interpreted as valid instructions by the model. The agent gathers sensitive local files, modifies Kiro’s internal security-relevant configuration, and leverages subsequent IDE capabilities to transform those modifications into network requests directed at an external endpoint (such as embedding data within Markdown image requests or MCP channels).

“The vulnerability occurs when attacker-controlled project content is interpreted as instructions, and those instructions are allowed to influence security-sensitive operations elsewhere in the IDE.” — Mindgard Research.

Affected Systems / Environments

  • Amazon Kiro IDE: Versions prior to 0.8.140 (specifically reproducing against version 0.7.45 on Windows in disclosed findings).
  • Related AI Tools and Coding Agents:
    • Claude Code: Versions prior to 2.1.75 on Windows (CVE-2026-35603) and versions prior to 2.1.2 with bubblewrap sandboxing flaws (CVE-2026-25725).
    • NVIDIA NemoClaw for Linux: Unauthenticated inference server setup (CVE-2026-65105).
    • Microsoft Visual Studio Code: MCP installation dialog impacted by session fixation vulnerabilities (CVE-2026-41613, aka Envade).
    • Additional ecosystems evaluated with similar prompt injection or hijacking flaws: Cursor CLI, OpenAI Codex CLI, Google Gemini CLI, OpenClaw, and Claude Desktop.

Mitigation and Detection

Remediation

  • Software Updates: Immediately upgrade Amazon Kiro IDE to version 0.8.140 or later (the latest release incorporates security fixes deployed by Amazon following responsible disclosure).
  • Vendor Patches: Apply corresponding updates for Claude Code (version 2.1.75 or higher), patch NVIDIA NemoClaw deployments, and keep Visual Studio Code components fully updated.
  • Workspace Handling Best Practices: Avoid opening workspaces or code repositories from untrusted sources using external workspace configuration files.

Detection

  • IDE Log Monitoring: Monitor for unauthorized modifications to sensitive configuration files (.vscode/tasks.json, .kiro/settings/mcp.json, or POWER.md and managed-settings.json files).
  • Network Traffic Inspection: Log outbound HTTP/HTTPS requests generated from development processes toward unknown external domains or suspicious parameters embedded in Markdown image URLs.
  • Detection Rules (Conceptual YARA Example for suspicious configuration artifacts):
yara 
rule Detect_Suspicious_Kiro_MCP_Manipulation {
    meta:
        description = "Detects potential automated tampering with Kiro MCP settings via steering files"
        author = "Honeynet Academic Blog"
        date = "2026-08-27"
    strings:
        $mcp_conf = "mcp.json" ascii nocase
        $steering = "POWER.md" ascii nocase
        $malicious_hook = "SessionStart" ascii nocase
    condition:
        $steering and ($mcp_conf or $malicious_hook)
}

Wrapping Up

The Amazon Kiro incident and the wider chain of vulnerabilities revealed across agentic AI coding tools demonstrate that modern development environment security extends far beyond traditional code defects. The convergence of natural language interpretation, local system access, and automated tool execution exposes developers to complex trust boundary failure risks. Rigorous adoption of secure development practices and timely component patching remain vital to minimizing the attack surface in the era of agentic AI.

References