"The issue allowed attacker-controlled repository content to influence the Kiro agent and ultimately cause sensitive local information to be transmitted to an external endpoint," security researcher Fergal Glynn wrote in a report shared with The Hacker News.
Kiro IDE 0.7.45 on Windows: the vulnerable build
Mindguard disclosed a vulnerability that affects Kiro IDE 0.7.45 on Windows and permits repository-controlled content to be interpreted as instructions that influence the agent and cause sensitive local information to be sent externally. The Hacker News notes that the latest Kiro release at the time of the disclosure is 1.0.337, and Mindguard reported the flaw as reproducible against both trusted and untrusted workspaces.
Kiro Powers and POWER.md steering files: how persistent context can be abused
Kiro Powers — which bundles Model Context Protocol (MCP) server configurations, steering files (notably "POWER.md"), hooks, and contextual knowledge — provides persistent guidance to the agent about what tools are available and when to use them. Mindguard described the steering file as an "onboarding manual" that supplies context to the AI agent; that same mechanism can be abused to cross trust boundaries. Mindguard previously demonstrated that a steering-file directive could cause local information to be incorporated into a Markdown image request and transmitted to an external server.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogExploitation steps: open workspace from file, send any message, and data leaves the host
Mindguard laid out two simple user actions required for exploitation. First, the user must open a malicious project through File → Open Workspace From File rather than opening the folder directly. Second, the user must send a message to the agent. Once those steps are satisfied, a crafted workspace file is sufficient: the user does not have to submit a malicious prompt or explicitly reference attacker-controlled content. Mindguard warned that "sending any message is enough to trigger the vulnerable flow," and assessed exploitation difficulty as low.
Mindguard summarized the vulnerable sequence this way: repository-controlled content influences the agent; the agent reads sensitive local information; the agent writes that information into a security-relevant IDE configuration; and a subsequent IDE capability turns the modified configuration into network activity. In Mindguard’s characterization, "The trust boundary failure occurs across the entire sequence."
Amazon's remediation (Kiro IDE 0.8.140) and an earlier CVE (CVE-2026-10591)
Following responsible disclosure, Amazon implemented a fix in Kiro IDE version 0.8.140. The advisory also connected the new finding to an earlier June 2026 disclosure: CVE-2026-10591 (CVSS score 8.8). That earlier issue could enable a remote unauthenticated actor to execute arbitrary commands via crafted instructions that write to execution-sensitive paths such as ".vscode/tasks.json" or "~/.kiro/settings/mcp.json" and facilitate auto-execution when a folder is opened.
Security firm Intezer described the prior June finding in blunt terms: "By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer's machine," and added that "No suspicious approval prompt is ever shown to the user. All the developer asked Kiro to do was perform a legitimate action."
Related AI tool vulnerabilities reported alongside the Kiro findings
- A vulnerability chain in OpenAI Codex CLI for Windows that abuses prompt injection through web.run to turn a routine web search into covert host-level command execution outside the built-in sandbox feature.
- A zero-click remote code execution vulnerability in Cursor CLI that uses indirect prompt injection to write a malicious executable to the workspace and execute it.
- An arbitrary code execution vulnerability in Cursor, GitHub Copilot CLI, Google Gemini CLI, and the Codex app for Windows caused by search order hijacking that allows an attacker to place a malicious binary with the same name as an external dependency in the current working directory before trusted system paths.
- A vulnerability impacting Anthropic Claude Code (CVE-2026-35603), Cursor, Codex CLI, and Google Gemini CLI that abuses a Windows folder trusted by these tools ("C:\ProgramData\") to drop a configuration file and allow a low-privileged attacker to have commands executed inside the session of any other user on the machine without prompts or elevation.
- A sandbox escape in Claude Code (CVE-2026-25725, CVSS score: 7.7) that allows an attacker with sandbox code execution to create a ".claude/settings.json" file containing a hook with arbitrary commands executed later on the host.
- Vulnerabilities in Gemini CLI that allow a sandboxed attacker to escape the container and run code on the host and to steal the user's Google OAuth token.
- A vulnerability in Codex CLI's sandbox that allows an LLM tool call to "apply_patch" to create and modify files in the .codex directory and achieve command execution via direct or indirect prompt injection.
- A vulnerability in NVIDIA NemoClaw (CVE-2026-65105, CVSS score: 8.1) that can give an attacker control of a local Ollama model server through a single visit to an attacker-controlled web page and plant hidden instructions inside the model's chat template.
- An OpenClaw flaw that allows any website to take control of a developer's AI agent by abusing a gateway's ability to accept localhost WebSocket connections.
- A Microsoft Visual Studio Code MCP install dialog vulnerability (CVE-2026-41613, CVSS score: 8.8, aka Envade) that, with a single click on a crafted deeplink, enables full code execution or routes MCP calls through an attacker's account.
- A Claude Desktop issue named PromptFiction, where a single click on a crafted link could trick the AI agent into unintended actions including harvesting sensitive data or running arbitrary code.
What this means for technologists, procurement leads, and defenders
Technologists and security teams will need to treat repository files and steering documents as part of the attack surface: the Kiro findings show that files meant to provide contextual help can be interpreted as executable instructions by agents. Procurement and enterprise application owners should verify that deployed IDE versions incorporate the Kiro 0.8.140 fix (or later) and confirm secure defaults around workspace import and MCP configuration handling. Defenders and incident responders should watch for unexpected MCP configuration changes and unusual outbound network activity tied to IDE processes, since Mindguard’s flow shows configuration writes can be converted into network requests without explicit user intent.
The Kiro disclosure is a reminder that as development tools integrate model interpretation, tool use, and application state, seemingly benign repository artifacts can bridge trust boundaries and convert context into actions. Amazon’s patch addresses the reported flow, but the larger pattern — steering files, MCP configs, and agent tooling creating new execution paths — remains a recurring vector across multiple tools.
