Amazon Kiro IDE Vulnerable to Prompt Injection, Exposing Sensitive Data

Researchers have identified a critical prompt injection vulnerability within Amazon Kiro, an AI-powered integrated development environment (IDE). The flaw, affecting version 0.7.45 on Windows, enables attackers to leverage the IDE's agentic capabilities, known as Kiro Powers, to extract sensitive information through carefully crafted prompts.

The vulnerability stems from how Kiro processes user inputs and interacts with its AI agent. By injecting malicious commands into prompts, an attacker can trick the Kiro Powers agent into executing unintended actions. These actions can include accessing and exfiltrating files, code, or other sensitive data stored within the IDE or accessible by the IDE's operating context. This bypasses normal security controls by exploiting the trust placed in the AI agent to perform legitimate tasks.

Mindguard, the security firm that disclosed the vulnerability, demonstrated a proof-of-concept showing how an attacker could potentially gain access to project files, configuration settings, or even credentials stored within the development environment. The exploit highlights a growing concern surrounding the security of AI-driven tools, particularly those integrated into development workflows where sensitive intellectual property and data are handled.

While no specific CVE identifier has been assigned to this vulnerability, its potential impact is significant. Developers using Amazon Kiro on Windows are at risk if they interact with malicious prompts or if their development environment is compromised in a way that allows prompt manipulation. The exfiltration of sensitive data could lead to intellectual property theft, exposure of proprietary code, or compromise of sensitive system configurations.

This incident underscores the broader security challenges posed by the increasing adoption of AI agents and LLMs in software development. As these tools become more sophisticated and integrated, they also present new attack surfaces. Prompt injection, a known class of vulnerability in AI systems, becomes particularly dangerous when the AI has access to sensitive system resources or data, as is the case with an IDE.

Currently, there is no patch available from Amazon for this specific vulnerability. Users are advised to exercise extreme caution when using Amazon Kiro IDE, particularly when dealing with external prompts or code snippets. Disabling or limiting the functionality of Kiro Powers, if possible, might serve as a temporary mitigation until a permanent fix is released.

The disclosure serves as a critical reminder for both developers and vendors of AI-powered tools. Developers must remain vigilant about the security implications of the tools they use, and vendors must prioritize robust security testing and input validation for AI agents to prevent such data exfiltration risks. The potential for AI agents to be manipulated for malicious purposes is a rapidly evolving threat landscape.