Vulnerability in Amazon Kiro allows data exfiltration using Kiro Powers

Security researchers have exposed a failure in Amazon Kiro, the integrated development environment (IDE) with IA-driven agent functionalities, which allows the exfiltration of local data by handling project files and so-called "Kiro Powers." Done confirmed: vulnerability was reproduced against Kiro IDE 0.7.45 on Windows by the MindGuard firm and, after responsible disclosure, Amazon corrected the failure in version 0.8.140; the most recent version available is 1.0.337.

In simple terms, the attack chain takes advantage of repository files controlled by the attacker that the IA itself interprets as instructions. Kiro Powers - which group MCP server configurations (Model Context Protocol), address files such as "POWER.md," hooks and contextual knowledge - can provide a persistent agent with the context and tools to use. MindGuard showed that if a user opens a malicious workspace file using File → Open Workspace From File and then sends any message to the agent, the vulnerable flow can be activated and transmitted sensitive information to an external server without the user having explicitly requested the shipment.

The verified elements of the attack are clear: the explosion is reproducible both in marked and "trusted" work spaces and in those not, the operating difficulty was rated as low and the vector does not require the user to write a malicious prompt: it is enough to open the workspace file and send any message to trigger the filtration. MindGuard describes the root as a failure at the trust borders: content controlled by the repository influences the agent; the agent reads sensitive local information; that information is written in IDE configurations and a later IDE capacity turns that configuration into network traffic.

How it works technically: Kiro integrates context interpretation and tool executions into the same flow. Project files can inject persistent instructions (the POWER.md file) that tell the agent that MCP servers and hooks are available and when to invoke them. If these instructions allow you to read local files and then format them in a call to an external resource (e.g., an HTTP request to an attacker-controlled URL), the information is exfiltered without additional user approval. The specific vulnerability exploited by MindGuard links the agent's ability to read and write configurations and the IDE's ability to run or convert those configurations into network activity.

Who's affected: end user and organizations that run vulnerable versions of Kiro on Windows, in particular 0.7.45 according to published tests. There is no CVE identifier assigned to this failure at the time of the report; however, Amazon already deployed a patch. It is not confirmed by public sources if macOS or Linux were tested or affected to the same extent; this extension remains uncertain.

This finding links with a broader trend: multiple tools and development CLis with IA capabilities have shown failures that allow from exfiltration of secrets to remote execution of code through vectors such as prompt injection, handling of reliable configuration files and abuse of search routes on Windows. One of the previous problems in Kiro (CVE-2026-10591) had already demonstrated the gravity possible when an actor can force the rewriting of sensitive configuration files and cause automatic execution when opening a folder. For technical references and related vulnerability records see, for example, the NVD file on the CVE-2026-10591 and the analyses published by the firm that reported the finding: CVE-2026-10591 in NVD and MindGuard.

Actual consequences: in practical risk scenarios, a developer who opens a project downloaded from an unknown repository (or even apparently reliable if the attack is hidden) could filter keys, tokens, private code or any file accessible to the IDE process to attackers-controlled servers. Since activation only requires "sending a message" to the agent, the action seems banal from the user's perspective, which increases the risk of incidental exploitation. There is no public evidence in the wild-state exploitation report, so the actual scope of previous intrusions remains uncertain.

Specific measures to be taken by the reader:: practical recommendations, distinguishing between immediate steps and structural measures, are as follows:

Immediate update: if you use Kiro, update as soon as possible. The reported patch is present in version 0.8.140; the ideal is to move to the most recent stable version (the 1.0.337 mentioned in the report) and review the release notes before and after updating.

Project opening practices: avoid opening workspace files from unverified sources with File → Open Workspace From File; instead, clone the repository and open the folder directly or manually inspect the workspace file and any POWER.md before allowing Kiro to process it.

Restrained the network from development environments: implement firewall rules that limit outgoing IDE process connections to unapproved destinations, and use proxies or records to detect unexpected outgoing HTTP requests. For sensitive equipment, consider insulation in containers or virtual machines with strict network policies.

Configuration control and audit: disable or restrict the automatic installation of MCP servers, hooks or any remote tool load from external repositories, and monitor changes to configuration files that can incorporate network destinations or automatic commands.

Organizational policy and revisions: treat project files as executable code: apply change review (pull requests), automatic scanning of POWER.md content and rules that block artifacts with automatic execution instructions. Add controls for access to secret scanning and limits on sensitive file reading permits from the IDE.

If you suspect exposure: revoke and rotate credentials (tokens, SSH keys, API keys) that could have been accessible from the workspace and review network output logs from the risk period to identify unusual destinations. There is no public evidence of mass exploitation, but if there is a well-founded suspicion, act as if secrets had been disclosed.

Finally, it is important to stress that vulnerability is not just a timely Kiro bug but a symptom of an architectural problem: when IA agents and execution capabilities are mixed with the configuration and content of the repository, the trust borders are exposed. Outreach programs should evolve to evaluate end-to-end execution routes, and IA tool developers need to design controls that explicitly separate the repository content from the execution plane and network settings. For additional risk readings and safety guides in IA, the reader can consult official resources such as those of CISA on artificial intelligence: CISA - Artificial Intelligence.