Cybersecurity firm Mindgard on August 27, 2026 disclosed a prompt-injection vulnerability in Amazon Kiro that let attacker-controlled repository content coerce the AI-powered IDE into transmitting sensitive local information to an external endpoint. Amazon fixed the flaw in Kiro IDE 0.8.140; the vulnerable build was 0.7.45 on Windows and no CVE was assigned.
How the exploit chained through Kiro Powers
Kiro Powers bundle Model Context Protocol server configurations, steering files (POWER.md), hooks and contextual knowledge that persistently instruct the agent about which MCP tools to use and when. Mindgard's researcher Fergal Glynn showed that once a user opened a malicious workspace via File to Open Workspace From File - rather than opening the folder directly - and then sent any message to the agent, hidden instructions in the crafted project were interpreted as legitimate context.
The agent then read local files, wrote sensitive data into security-relevant IDE configuration, and let a downstream Kiro capability convert the modified configuration into outbound network activity. The user did not have to write a malicious prompt or reference the poisoned content. Mindgard rated exploitation difficulty as low and demonstrated the chain against both trusted and untrusted workspaces.
Second Kiro flaw in three months
The disclosure builds on an insufficient access control bug Amazon patched in June 2026, tracked as CVE-2026-10591 with a CVSS score of 8.8. That earlier flaw let unauthenticated actors write to execution-sensitive paths such as .vscode/tasks.json and ~/.kiro/settings/mcp.json, triggering auto-execution on folder open. Intezer showed the same class of bug could make Kiro rewrite its own MCP server configuration file when the agent parsed a poisoned web page.
Part of a wider agentic-IDE security reckoning
Mindgard's report lands alongside a run of prompt-injection findings in AI developer tools: sandbox escapes in Anthropic's Claude Code (CVE-2026-25725), a zero-click RCE chain in Cursor CLI, arbitrary-code execution in OpenAI Codex CLI and Google Gemini CLI, and an NVIDIA NemoClaw flaw (CVE-2026-65105) that hijacked local Ollama servers with a single web visit. For related coverage of AI-focused vulnerability disclosures, see our GitLab GraphQL flaw report and UK-Ukraine AI defence pact.
Mitigation and the takeaway
Kiro users should update to 0.8.140 or later and, per Mindgard, treat any workspace opened from a shared or third-party repo as untrusted context. Mindgard argues the wider issue is that AI IDEs collapse interpretation and execution into the same workflow, so vulnerability disclosure programs need to evaluate agent execution paths at the same fidelity as researchers testing them.
Reporting based on coverage from The Hacker News and Mindgard.