Researchers have uncovered a critical security flaw in Amazon’s Kiro AI-powered IDE that allows attackers to exfiltrate sensitive local data via prompt injection. The weakness affects Kiro IDE version 0.7.45 on Windows; the most current version is 1.0.337. The issue was discovered and reported by Mindguard.
How the Flaw Works
Kiro includes a feature called Kiro Powers, which lets projects bundle “steering” files, hooks, and model-server config via the Model Context Protocol (MCP). The steering file—POWER.md—acts like persistent instructions: it tells the AI agent what tools are available under which circumstances. If a user opens a workspace file from a malicious repository (through File → Open Workspace From File) rather than navigating directly to the folder, that steering file can influence the agent and ultimately leak local data—simply by the user sending any message to the agent.
Notably, the attack doesn’t require the user to request the data or reference the malicious content explicitly. Once the crafted workspace is opened and a message is sent, the chain of trust can be broken: the agent reads private files, writes to sensitive configuration, and triggers network activity—all without alerts or elevated permissions. Researchers describe the exploitation as “low difficulty.”
Patch and Wider Implications
Following responsible disclosure, Amazon patched the vulnerability in version 0.8.140 of Kiro IDE. This comes amid a wave of security problems in AI tools—previous flaws in Kiro included a steering file bug that leaked data via Markdown image requests. Earlier in 2026, an access control issue (CVE-2026-10591) let unauthenticated attackers execute commands by modifying configuration files in execution-sensitive paths.
Experts warn that as AI-focused development environments combine model interpretation and execution with configuration, repositories become potential attack vectors. When project files, steering instructions, and agent behavior all interact, trust boundaries collapse. Vulnerability disclosure programs must adapt to address complex flows involving model context, config files, and external resource interaction—not just simple, isolated software bugs.
What this means for developers: always update to the fixed version, avoid opening untrusted workspaces via steering files, and monitor any AI tools that allow repository content to influence agent behavior. As AI tools proliferate, the boundary between trusted content and malicious instruction will only blur further.
