Amazon Kiro Prompt Injection Flaw Leaked Secrets via Kiro Powers

A booby-trapped workspace and one ordinary message

Security firm Mindgard has published details of a prompt injection flaw in Amazon Kiro, the company's agentic AI coding environment. A malicious project could steer Kiro's AI agent into reading a local secret and sending it to a server the attacker controls, using the Kiro Powers feature to make the final network request.12 Mindgard tested Kiro IDE 0.7.45 on Windows and got the same result whether the workspace was marked trusted or untrusted.2 Amazon says it fixed the problem months before the public writeup. Amazon told The Hacker News the fix shipped in the January 15 Kiro update, and the reporting names version 0.8.140 as the patched release.1

The attack takes very little from the victim. They have to open the project with File → Open Workspace From File rather than opening the folder directly, and then send the agent a message.1 The message can say anything. It doesn't have to mention the planted files or contain anything suspicious.11 Mindgard rated exploitation difficulty as low.2

No source reports anyone using this against real users. The proof of concept leaked a dummy API key, not a real credential.6

How the chain works

The attack is worth studying because it doesn't use a classic memory bug or a direct code-execution trick. It chains together features that are each legitimate on their own.3 Mindgard's proof of concept had three parts. The first was a folder under a .stuff directory whose name told the agent to open an index.md file and do what it said. The second was the index.md file, which told the agent to search the workspace for a secret, paste the result into a placeholder, and call the Kiro Powers configure action. The third was a .code-workspace file that set kiroAgent.powersRecommendationUrl to an attacker-controlled address ending in that placeholder.2 A .env file with a sanitized OPENAI_API_KEY stood in for the target.2

In Mindgard's testing, the agent did exactly what the planted text asked. It found and read the key, wrote it into the recommendation URL, and called the Powers tool. The IDE then fetched that URL with the secret in the query string.2 Kiro Powers bundle MCP server configurations, steering files, hooks and context, so the feature already has a normal reason to contact a remote registry. That is the request the attacker borrowed.11

Mindgard describes the root cause as a trust boundary failure across the whole sequence, not a single bug. Repository text influences the agent, the agent reads sensitive data, writes it into security-relevant configuration, and another part of the IDE turns that configuration into network traffic.1 The NSFOCUS analysis makes a practical point: because the data leaves through the IDE's own network channels, endpoint detection and data loss prevention tools would struggle to tell it apart from normal developer traffic.3

Where the accounts disagree

The outlets agree on the attack chain. They differ on three details: CVE status, the patch date, and whether users got any warning.

CVE status. In August, The Hacker News reported that the flaw had no CVE identifier.1 Mindgard wrote that Amazon's vulnerability disclosure program had asked its CVE team to assess eligibility, with a decision still pending.2 In late September, AWS published a bulletin for CVE-2026-89332. It describes the Kiro agent editing a workspace settings file in an untrusted workspace so that the Kiro Powers registry URL points at an outside endpoint, sending potentially sensitive workspace data there.10 That matches Mindgard's chain closely enough that the bulletin is most likely the outcome of the pending review, though AWS doesn't name the researchers. One wrinkle: AWS lists versions below 0.8.135 as affected, while Amazon's earlier statement and the press coverage name 0.8.140 as the fix.101

Patch date. Mindgard's timeline says Amazon verified the report and released the fix on January 26, 2026. Amazon's spokesperson pointed to a January 15 update.21 The incident tracker Vibe Graveyard flagged this mismatch and left it unresolved.6 Either way, the fix landed roughly seven months before public disclosure, as one reviewer noted.9

User warnings. Mindgard's account and the Mallory summary say the leak happened without the user asking for it and without approval prompts.27 AWS's bulletin gives a different picture. It says Kiro did show the edit for approval, including the inserted data and the URL. But the file had already been written to disk, so opening the Powers panel before answering the prompt sent the request anyway.10 These accounts can both be true if different builds or paths behaved differently. For defenders the result is the same: the approval dialog appeared after the damage was possible.

The same pattern keeps coming back

This is the clearest point across the coverage. Kiro has a recurring problem with agents that can rewrite the files that decide what the IDE does next. In July 2026, Intezer and Kodem Security showed that hidden one-pixel white text on a web page could get Kiro to rewrite ~/.kiro/settings/mcp.json and launch attacker code. The approval pop-up made no difference because the configuration reloaded whatever the user clicked.15 AWS tracked that issue under CVE-2026-10591, which also covered writes to .vscode/tasks.json that could auto-run when a folder was opened.1115 According to The Hacker News, the same mcp.json write-to-execution technique was first shown on Kiro's launch day in July 2025 by Johann Rehberger of Embrace The Red.15 AWS's own bulletins from 2025 describe prompt injection issues in Kiro and Amazon Q Developer that it fixed by requiring human confirmation for certain commands.5

AWS's response to CVE-2026-10591 was to stop relying on the model's judgment for sensitive files. Kiro now marks mcp.json, tasks.json, the .git directory and similar paths as protected, and writes to them need explicit approval.15 The Powers leak shows why a list like that falls short. The .code-workspace file and its Powers URL setting were not on any execution list, but the setting controlled where the IDE sent network requests. Writing to it turned out to be enough to leak data. In this reading, any configuration value that controls a network destination or a process launch is as sensitive as a file that runs code, and allow-lists that don't treat it that way will keep losing to slightly different chains.

Mindgard's own history shows how close these variants are. Its first Kiro report used steering-file instructions to put local file contents into a Markdown image URL.1 HackerOne marked that report a duplicate. Mindgard went back to testing, found the Powers path, and filed again the same day.2 The company argues that bug bounty triage for AI systems often confuses a shared outcome, data exfiltration, with a shared root cause.2 That's a fair criticism, and so is its complaint about the reward: a $40 Amazon merchandise gift certificate for an accepted finding.2 Scoring AI flaws by what happened in the end, rather than how, encourages researchers to stop at the first duplicate. The Kiro record suggests there is almost always another path.

Why it matters beyond Kiro

Coding agents are now a target for credential theft. This month The Hacker News reported that the Shai-Hulud worm, spread through a compromised Tensorlake npm package, steals .env files along with configuration and MCP files for Kiro, Claude, Cursor, Windsurf and Zed. The Mindgard proof of concept went after the same kind of file.2 Kiro's own documentation warns that MCP servers run with the agent's full privileges and can leak code, credentials and data without further confirmation.13

Commentators disagree on how far a fix has to go. A Codex CLI-focused analysis says AWS's protected paths treat the symptom while leaving a single click as the only barrier, and argues for operating-system sandboxing and default network isolation instead. Vibe Graveyard points to narrower controls for secrets: redact values in tool output, keep .env out of broad workspace searches, and block outbound requests whose destinations contain credential-shaped strings.6 Both arguments come down to the same thing. Prompt injection can't be reliably blocked at the model, so the limits have to sit underneath it.

What developers should do now

The immediate steps are simple. AWS recommends upgrading to the latest Kiro and rotating any credentials stored in projects opened on older versions.10 The Hacker News lists the current build as 1.0.337.1 Teams should also treat a .code-workspace file from an unknown source as executable input, not as harmless settings. As one review put it, "we only open trusted repositories" is not enough protection when merely reading content has repeatedly been enough to trigger an attack.9

This particular bug is patched. Kiro's design is not. It still gives a model that reads untrusted text the ability to change its own settings and reach the network, and the fixes so far have closed specific paths rather than that underlying capability.