Amazon Kiro Prompt Injection
How much should we trust AI?
AI. This 2 letter acronym has completely taken over our society today. When watching a video, we may find ourselves asking "Is this AI?". Every company talks about AI and how it can make us more efficient. AI-assisted development seems to be the floor in today's engineering landscape. However, this is not without its risks. Even ChatGPT itself says the following above its prompt box: ChatGPT can make mistakes. Check important info. And that's just about checking the answer to your question. An attacker can go further, and let's see how that materialised in Amazon Kiro.
Background
To understand the attack, we first need to know how Amazon Kiro works. Amazon Kiro is essentially an AI-assisted IDE that allows a developer to integrate an agent into their workflow. Some capabilities include reading workspace content, modifying files, and invoking Kiro-native functionalities. While this may seem harmless, this lack of boundaries is exactly what becomes an attack surface when a malicious actor gets a hold of it.
Attack Flow
Following the rudimentary diagram drawn by myself, the attack is actually fairly straightforward. An attacker creates a malicious project with their own content, and the notable aspects of the project are an index.md file specifying instructions for the agent to follow and a .code-workspace configuration file. The .env file was intentionally included by the researchers at Mindgard who discovered this vulnerability as part of their POC.
Now, the user must open the project through a workspace rather than directly opening the folder for this attack to succeed. Then, the user must send a message to Kiro, and the attack starts. This message doesn't even need to be a malicious injection attempt. A single message about anything, and the agent first reads the instructions specified in index.md. The agent is then instructed to read files and retrieve data, which in the simulated attack was an OpenAI API key from the .env file. The next instruction is for the agent to replace a query placeholder in a configuration URL with the retrieved secret. That URL was injected as part of the attacker's project in the .code-workspace configuration file, and this URL relates to the Kiro Powers function, where a Power is defined as a bundle of Skills/Instructions + MCP tools + Other Kiro specific configuration. This ties into the final instruction, where Kiro is made to invoke the Powers configuration tool. Kiro will attempt to retrieve the Power from that attacker-controlled URL which it has modified to contain the victim's local secrets. All the attacker needs to do is monitor HTTP requests and retrieve sensitive data from the victims from their query parameters.
Vulnerability
As TheHackerNews stated so succinctly, the vulnerability here is trust boundary failures. Attacker controlled content from an external project is able to influence the agent. The agent is able to read sensitive local information and write it elsewhere. Most importantly, it can make network requests to external IP addresses with configuration information included. Automation and efficiency are great to have, but it cannot come at the cost of security. Nevertheless, it should be noted that this vulnerability was found on Kiro IDE 0.7.45 on Windows according to Mindgard, and the latest version is 1.0.337 according to TheHackerNews. A simple patch would remove this vulnerability, but its lessons remain. Being overly permissive or too trusting with AI tools still poses significant risk, and if we are too quick to remove ourselves from their workflow, our secrets will become everyone's secrets.
Mitigation
Although the remediation in this case was just updating to a later version of Kiro, brainstorming other mitigation strategies often uncovers interesting new ideas or meaningful findings. The patch doesn't always get released immediately too, and there are a few mitigation strategies I can think of. Firstly, I feel that permissions could have been asked from the user for critical actions. Now, defining critical actions is a separate issue, but for a start, if API keys are being written somewhere else, surely that should have at least required some level of user interaction. Security boundary was the key issue here, and that naturally leads into an effective mitigation which is to treat external repository content as untrusted and distinguishing between user and system instructions, as well as data. Output sanitization could also have been employed here. Personally, I have attempted to work on something similar myself, which is my project Portalis . Finding the right boundary between what is considered acceptable output and what is not was slightly challenging for me in a wider context, but if we focus merely on API keys that follow a standardised pattern, then this should be effective in preventing leakage of API credentials. Lastly, as the victim who may have had their credentials compromised, rotation of tokens or generating new API keys always serves as a useful interim mitigation while waiting for a patch from the vendor.
Wider Trend
Amazon Kiro is perhaps more niche compared to the big players we would all know and probably use more often. And so, if you find yourself thinking that this is just one rare attack that probably won't affect you, think again. According to TheHackerNews, this is just a drop in the ocean of recent vulnerabilities attributed to AI tools. CVE-2026-35603 describes a vulnerability that allows a low-privileged attacker essentially execute commands in other users' sessions without any indicator (prompt or warning), and this affected Claude Code, Cursor, Codex CLI and Gemini CLI. Other vulnerabilities enable an attacker to escape the container boundary of an LLM and execute arbitrary code on the host system, or even hijack credentials. This serves as an important reminder. Just reading news and understanding how someone else's system got exploited is not sufficient. Take that one step further, and apply it to the systems you build or are responsible for. Experiment with the same attack flow, discover any loopholes before someone else does.