AI Agent Vulnerability: Amazon Kiro IDE Flaw Enables Data Exfiltration via Prompt Injection and Kiro Powers
Executive Summary
Cybersecurity researchers from Mindguard have disclosed technical details surrounding a critical security vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered agentic Integrated Development Environment (IDE). The flaw allows untrusted repository content to hijack the autonomous Kiro AI agent through indirect prompt injection, abusing the platform's extensible configuration feature—known as "Kiro Powers"—to silently exfiltrate proprietary source code, private SSH keys, and cloud API tokens to external attacker-controlled endpoints. This disclosure highlights the expanding attack surface introduced by autonomous AI agents operating with local tool execution capabilities in modern developer environments.
Deep-Dive Technical Analysis
The vulnerability affects Amazon Kiro IDE version 0.7.45 running on Windows (and has been remediated in version 1.0.337). The exploit chain leverages the interaction between Model Context Protocol (MCP) servers, steering files, and agent context loading:
1. Architecture of Kiro Powers
Amazon Kiro introduces "Kiro Powers," a modular framework bundling Model Context Protocol (MCP) server configurations, persistent steering files (POWER.md), custom lifecycle hooks, and contextual domain knowledge. The POWER.md file acts as an authoritative operational guide that informs the underlying LLM which MCP tools are available and dictates execution rules.
2. Indirect Prompt Injection Vector
When a developer clones an untrusted repository or opens a project containing malicious comments or documentation (such as a poisoned README.md or embedded code comments), the Kiro agent parses the repository content into its active context window.
* The embedded payload contains instructions designed to override system safety rules and mimic authoritative administrative directives.
* The injection manipulates the agent into invoking local file-reading MCP tools (such as reading ~/.ssh/id_rsa, .env configuration files, or AWS credential stores).
3. Silent Data Exfiltration via Tool Abuses
Once sensitive local context is retrieved into the model's memory, the injected prompt instructs the agent to leverage external MCP network tools, web browsing components, or formatted markdown image tags (!exfil) to transmit the sensitive data to remote command-and-control servers, all without triggering traditional IDE alerts or user confirmations.
Industry Impact and Mitigation Strategies
As developers increasingly adopt autonomous AI IDEs and coding agents capable of reading, executing, and modifying local codebases, the boundary between data parsing and code execution has blurred. Traditional static analysis tools are largely blind to natural language prompt injections embedded in non-executable files.
Key Security Recommendations
* Upgrade Kiro IDE Immediately: Ensure Amazon Kiro IDE is updated to version 1.0.337 or higher, which introduces strict containment boundaries around Kiro Powers and context loading.
* Implement Strict MCP Tool Permission Scoping: Enforce the principle of least privilege on all Model Context Protocol (MCP) tool registrations. Tools with file-read access should not have simultaneous unrestricted outbound network access within the same agent session.
* Enforce Human-in-the-Loop (HITL) Controls: Require explicit user confirmation before an AI agent executes tools that access sensitive local directories (.ssh, .aws, credential managers) or transmit data to external URLs.
* Treat Untrusted Repositories as Untrusted Binaries: Sandboxing and containerized development environments (such as Dev Containers or isolated VMs) should be mandatory when reviewing or opening third-party open-source code repositories.