Critical Security Flaw Discovered in Amazon Kiro IDE
AI-powered development environment at risk of sensitive data exfiltration.
1Critical Vulnerability in Kiro IDE
A security vulnerability has been discovered in Amazon's AI-powered development environment, Kiro IDE, that could allow malicious actors to exfiltrate sensitive data. The flaw, uncovered by Mindguard, specifically affects Kiro IDE version 0.7.45 running on Windows. The vulnerability is triggered when users open a malicious workspace file and then engage in any messaging with the agent. No explicit user consent is required for the exploit to work.
2Exploit Mechanism and Risks
The vulnerability operates through a feature called Kiro Powers, which bundles Model Context Protocol (MCP) server configurations, steering files, and contextual knowledge. Steering files act as an 'onboarding manual' that tells the AI agent which tools are available and when to use them. A malicious steering file can be crafted to read a local file and incorporate it into a Markdown image request.
3Exploitation Conditions
Two user actions are required to exploit the vulnerability: the user must open the malicious project via 'File → Open Workspace From File' instead of opening the folder directly, and then send any message to the agent. Mindguard notes that when these conditions are met, sensitive workspace data can be exfiltrated to the attacker without explicit user consent. The exploitation difficulty is assessed as low.
4Trust Boundary Violation
According to Mindguard, the security flaw emerges when attacker-controlled project content is interpreted as instructions that are then allowed to influence security-sensitive operations elsewhere in the IDE. The trust boundary violation occurs when the agent reads sensitive local information and writes it into security-relevant IDE configuration.
5Connection to Previous Disclosures
This vulnerability builds upon a previous bug highlighted by Mindguard that allowed steering-file directives to cause local information to be incorporated into a Markdown image request and transmitted to an external server. Amazon implemented a fix for the flaw in Kiro IDE version 0.8.140 following responsible disclosure. However, this is not the first security vulnerability discovered in Kiro.
6Historical Similar Vulnerabilities
In June 2026, Amazon addressed an insufficient access control flaw (CVE-2026-10591, CVSS score: 8.8) that could have enabled remote unauthenticated command execution via crafted instructions writing to execution-sensitive paths like '.vscode/tasks.json' or '~/.kiro/settings/mcp.json'. Intezer noted that such vulnerabilities could be exploited without showing any suspicious approval prompt to the user.
7Security Issues in AI Tools
The Kiro findings expose a problem that extends beyond one IDE or one disclosure program. Mindguard states that AI vulnerabilities can emerge from interactions between model interpretation, application logic, tools, configuration, and external resources, making them difficult to evaluate using disclosure processes designed around more clearly defined software defects. As AI systems gain more tools and interact with more application state, vulnerability disclosure programs need to evolve accordingly.
8Conclusions and Recommendations
As AI-powered development environments grow in popularity, an increase in security vulnerabilities is expected. Mindguard emphasizes that as AI systems interact with more tools and application states, vulnerability disclosure programs must evaluate execution paths with the same level of detail as researchers discovering them. Users are advised to regularly apply security updates and avoid opening suspicious workspace files, especially in AI-assisted IDEs.
Original article: The Hacker News — Amazon Kiro IDE'de Kritik Güvenlik Açığı