Researchers at Mindguard have uncovered a prompt injection vulnerability in Amazon Kiro, an AI-powered agentic IDE, that enables attackers to exfiltrate sensitive data through exploited Kiro Powers. The vulnerability affects Kiro IDE version 0.7.45 running on Windows systems and currently lacks a CVE assignment.
Kiro functions as an agent-based development environment where AI assists developers with coding tasks and automation. Kiro Powers expand this capability by allowing the IDE to execute external actions and integrations. The vulnerability stems from insufficient input validation on user prompts, permitting attackers to inject malicious instructions that bypass the system's intended safeguards. Once injected, malicious prompts can manipulate Kiro Powers to access, retrieve, and transmit confidential data stored within the development environment or accessible through connected systems.
Prompt injection attacks represent a growing threat vector against AI systems. Unlike traditional code injection, these attacks exploit the natural language processing layer. An attacker crafts seemingly benign text that contains hidden instructions, which the AI system interprets as legitimate commands. In Kiro's case, an attacker could embed injection payloads in code comments, project files, or direct IDE input to trigger unintended behavior. The Kiro Powers framework compounds this risk by providing the IDE with legitimate execution capabilities that attackers can repurpose for malicious ends.
The attack scenario works like this. A developer opens a malicious code repository or accepts what appears to be a helpful code snippet containing hidden prompt injection payloads. When Kiro processes this input, the injected instructions trick the AI layer into invoking specific Kiro Powers. These powers then execute actions the attacker specified, such as reading environment variables containing API keys, accessing local configuration files with credentials, or exfiltrating project source code containing trade secrets or authentication tokens.
Organizations using Kiro IDE face direct exposure if developers work with untrusted code repositories or receive code from external sources without thorough review. Developers' machines often store sensitive credentials, SSH keys, and API tokens in environment variables or configuration files. A successful attack grants attackers access to these materials without triggering traditional security alerts. The exfiltrated data could then enable lateral movement into production systems, cloud environments, or connected services.
Amazon has not yet published an official security advisory or patch for this issue. Mindguard's disclosure timing suggests the vendor has been notified. Users of Kiro IDE 0.7.45 on Windows should treat all external code and prompts as potentially malicious until a patch becomes available. Practical mitigations include running Kiro in isolated development environments, disabling unnecessary Kiro Powers where possible, avoiding opening untrusted repositories, and carefully reviewing any code suggestions the IDE generates before executing them.
This vulnerability highlights a broader challenge in AI-assisted development tools. As AI systems become more integrated into developer workflows, they introduce new attack surfaces that traditional security controls may not detect. The combination of prompt injection techniques and executable system access creates conditions for unauthorized data theft that developers may not immediately recognize as compromise. The security research community continues identifying similar flaws across AI coding assistants from various vendors.