As reported by The Hacker News, researchers at Mindguard have disclosed a prompt injection vulnerability in Amazon Kiro — an AI-powered agentic IDE — that enabled silent exfiltration of sensitive local workspace data through Kiro Powers, a feature bundling MCP server configurations, steering files (POWER.md), hooks, and contextual knowledge. The flaw affects Kiro IDE 0.7.45 on Windows and was remediated in version 0.8.140 following responsible disclosure. No CVE identifier has been assigned.

AI Security Alert: As reported by The Hacker News, researchers at Mindguard have disclosed a prompt injection vulnerability in Amazon Kiro — an AI-powered agentic IDE — that enabled silent exfiltration of sensitive local workspace data through Kiro Powers, a feature bundling MCP server configurations, steering files (POWER.md), hooks, and contextual knowledge.

The Real Story: Trust Boundary Collapse in Agentic Toolchains

The technical mechanics of this vulnerability are less interesting than the architectural pattern it exposes. This is not a classic buffer overflow or deserialization bug — it is a semantic trust boundary failure inherent to how agentic AI environments operate. Repository content (untrusted input) is interpreted as instructions by the LLM agent. The agent then reads sensitive local files, writes that data into IDE configuration, and a subsequent IDE capability transforms that modified configuration into outbound network activity. At no single step does the system flag an obvious violation — yet the composite flow results in data exfiltration.

The most dangerous aspect: the user never has to submit a malicious prompt. Once the crafted workspace file is opened, sending any message to the agent is sufficient to trigger the vulnerable chain.

This is the agentic AI equivalent of a confused deputy problem, and it is not unique to Kiro. Any IDE that allows repository-controlled content to influence an LLM agent with tool access — file reads, MCP server invocation, configuration writes, network calls — carries the same structural risk. Cursor, Windsurf, GitHub Copilot Workspace, and similar tools all share varying degrees of this attack surface.

Why Kiro Powers Amplifies the Risk

Kiro Powers introduces a persistent steering layer (POWER.md) that acts as an onboarding manual for the agent — telling it which MCP tools are available and when to use them. This is a powerful design choice for usability, but it significantly expands the injection surface. When attacker-controlled repository content can influence the steering context, the agent's entire decision-making framework is compromised. The agent doesn't just receive a bad instruction — it receives a bad worldview.

Who Is at Risk

Why Kiro Powers Amplifies the Risk
Development teams using Kiro IDE at versions prior to 0.8.140, particularly those opening external or third-party workspace files
Open-source contributors who clone untrusted repositories and open them in agentic IDEs
Enterprises where developers handle proprietary code alongside public dependencies, creating a path for supply-chain-driven exfiltration
Any organization using agentic IDEs with MCP tool integration — the pattern is broader than Kiro alone

Shield53 Recommendations

Immediate Actions

  • Update Kiro IDE to version 0.8.140 or later immediately. The current release (1.0.337) is safe.
  • Audit developer workstations for instances of Kiro IDE below 0.8.140 and enforce updates via endpoint management.
  • Restrict workspace file opening — advise developers to avoid File → Open Workspace From File for repositories from untrusted sources; open folders directly instead.
  • Network-level controls: Implement egress filtering on developer endpoints to flag unexpected outbound connections from IDE processes. This would have caught the exfiltration step regardless of the prompt injection.

Strategic Defenses for Agentic IDEs

  • Treat all repository content as untrusted instruction input. Steering files, .md files, and configuration artifacts within repositories should be sandboxed from influencing agent tool-selection logic.
  • Implement explicit user confirmation gates for any agent action involving file reads outside the workspace, configuration writes, or outbound network calls. Silent autonomous execution of these actions is the root cause.
  • Segment MCP tool permissions. Not every project context needs access to every MCP server. Apply least-privilege scoping per workspace.
  • Deploy prompt injection detection at the agent input layer — pattern-based and model-based classifiers can flag adversarial instructions in repository content before the agent acts on them.
  • Establish an agentic IDE security policy as part of your secure development lifecycle. Most organizations have no formal guidance governing AI-assisted development tooling. That gap is now actively exploitable.

This vulnerability is a preview of a much larger problem class. As IDEs evolve from passive editors into autonomous agents with file system, network, and tool access, the attack surface grows exponentially. The security community needs to move from reactive CVE-by-CVE patching toward proactive architectural standards for agentic development environments — before the next incident involves not just data exfiltration, but autonomous code modification in production repositories.