Cybersecurity researchers have uncovered a security weakness in Amazon Kiro, an AI-powered development environment, that lets attackers steal sensitive information through prompt injection without requiring users to submit malicious commands. Mindguard disclosed the vulnerability, which affects Kiro IDE version 0.7.45 on Windows, in a report shared with The Hacker News. The flaw allowed content from attacker-controlled repositories to manipulate the Kiro agent and force it to transmit private local data to external servers.
The vulnerability works when users open a malicious project through a workspace file using File → Open Workspace From File, rather than opening the folder directly, and then send any message to the agent. According to Mindguard, the flaw is reproducible against both trusted and untrusted workspaces, and exploitation difficulty is rated as low. What makes this weakness notable is that users don't have to submit a malicious prompt or reference attacker-controlled content—once the crafted workspace file is opened, sending any message triggers the vulnerable flow. The issue takes advantage of Kiro Powers, which bundles Model Context Protocol server configurations, steering files, hooks, and contextual knowledge to guide the AI agent. Amazon patched the flaw in Kiro IDE version 0.8.140 following responsible disclosure.
"The vulnerability appears when attacker-controlled project content is interpreted as instructions, and those instructions are allowed to influence security-sensitive operations elsewhere in the IDE," Mindguard stated. The report explains that the trust boundary failure occurs across the entire sequence: repository-controlled content influences the agent, the agent reads sensitive local information, the agent writes that information into security-relevant IDE configuration, and a subsequent IDE capability turns the modified configuration into network activity. The vulnerability builds on a previous bug highlighted by Mindguard that allowed steering-file directives to incorporate local information into a Markdown image request and send it to an external server. This isn't the first security issue in Kiro—Amazon addressed an insufficient access control flaw in June 2026 (CVE-2026-10591, CVSS score 8.8) that could have enabled remote unauthenticated actors to execute arbitrary commands.
As AI development environments increasingly combine interpretation and execution within the same workflow, repository files can provide context to models while agents read files, invoke tools, and activate functionality, potentially leading to trust boundary failures. The findings join a growing list of security issues discovered in AI tools, including vulnerability chains in OpenAI Codex CLI, zero-click remote code execution in Cursor CLI, arbitrary code execution in Cursor and GitHub Copilot CLI stemming from search order hijacking, and sandbox escape vulnerabilities in Claude Code and Gemini CLI. "The Kiro findings expose a problem that extends beyond one IDE or one disclosure program," Mindguard said, noting that AI vulnerabilities can emerge from interactions between model interpretation, application logic, tools, configuration, and external resources, making them difficult to evaluate using disclosure processes designed around more clearly defined software defects. The report recommends that as AI systems gain more tools and interact with more application state, vulnerability disclosure programs need to evaluate execution paths at the same level of detail as researchers discovering them. The wave of similar flaws across multiple AI development tools suggests the industry faces a fundamental challenge in establishing trust boundaries when code assistants act on behalf of developers. Organizations deploying AI-powered development environments may need to reconsider how they evaluate repository trust and agent permissions in their security models.