Amazon Kiro Vulnerability Allows Data Exfiltration Via Prompt Injection

Cybersecurity researchers at Mindguard have detailed a significant vulnerability within Amazon Kiro, an artificial intelligence (AI)-powered agentic integrated development environment (IDE). This security flaw enables sensitive data exfiltration through prompt injection attacks, leveraging a feature known as Kiro Powers. The vulnerability, which has not yet been assigned a CVE identifier, was demonstrated to be effective against Kiro IDE version 0.7.45 running on the Windows operating system. Mindguard's analysis indicates that the attack vector exploits the way Kiro processes user prompts and interacts with its integrated "Powers" functionality, which is designed to extend the IDE's capabilities through AI agents.

Prompt injection is a type of security exploit where malicious instructions are embedded within the input given to an AI model. In the context of Kiro, an attacker could craft a specific prompt that, when processed by the AI, tricks the system into executing unintended commands or revealing confidential information. The "Kiro Powers" feature, intended to enhance developer productivity by allowing AI agents to perform tasks like code generation, debugging, or system interaction, appears to be the conduit for the data exfiltration. This means that an attacker could potentially gain access to code, configuration files, credentials, or other sensitive data that the Kiro IDE has access to on the developer's machine or connected systems.

The researchers highlighted that the vulnerability is particularly concerning because Kiro is designed to be an integrated development environment, a tool that typically handles highly sensitive project-related information. The ability for an attacker to remotely trigger data leakage through a crafted prompt represents a substantial security risk for developers and organizations using the platform. While the specific version 0.7.45 on Windows is confirmed to be affected, it remains unclear if other versions or operating systems are also susceptible, though the researchers' focus on this specific configuration suggests it was the primary target of their investigation. The lack of a CVE identifier means that official tracking and patching efforts may not yet be fully underway, leaving users potentially exposed.

Amazon has not yet publicly commented on the vulnerability or released any patches. Developers using Amazon Kiro are advised to exercise caution with prompts and to monitor official Amazon security advisories for any updates or mitigation strategies. The discovery underscores the ongoing challenges in securing AI-powered development tools, where the integration of AI agents and complex functionalities can introduce novel attack surfaces. The exploit's reliance on prompt injection, a known but evolving threat in the AI security landscape, further emphasizes the need for robust input validation and security controls within AI systems, especially those operating with elevated privileges in development environments.