Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Summary: Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that works against version 0.7.45 on Windows and lets attacker-controlled repository content push sensitive local data to an external endpoint without a CVE. Exploitation requires the user to open a malicious project via File → Open Workspace From File and then send any message to the agent, and Amazon fixed it in Kiro IDE 0.8.140 on January 15.
Bottom line: The user never types a malicious prompt or references the attacker's content - opening the crafted workspace and sending any message is enough, and Mindgard rated exploitation difficulty as low. The same trust boundary failure sits in every agentic IDE that reads repository files as instructions while holding the ability to write config and make network calls.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2026-10591
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026