Amazon Kiro IDE had a deceptively simple weakness: it trusted repository content to influence its tool behavior. Mindguard researcher Fergal Glynn documented how an attacker could embed malicious instructions in workspace files, causing Kiro to read .env secrets and exfiltrate them by modifying the agent’s configuration URL. Just two user actions were needed.
This previews a vulnerability category traditional security hasn’t settled. Kiro did nothing obviously wrong: the configuration option existed, the Powers recommendation system worked as intended, the agent correctly read credentials it had access to. Chaining these features together via prompt-injection created an exfiltration vector no single feature would enable.
The real issue isn’t Kiro; it’s the pattern. Any AI agent that takes configuration from untrusted sources (repository files, chat logs, uploaded documents) becomes an attack relay. The agent isn’t compromised; it’s executing exactly as designed, just with corrupted inputs. Amazon patched this in 0.8.140 and addressed related issues in 0.11, but the lesson is clear: AI development tools need explicit trust boundaries, not just feature isolation.
Sources: Amazon Kiro Data Exfiltration • AWS Security Bulletin 2026-037
Coverage: The Hacker News
Related on this blog: [AUTO] Grok’s Trust Boundary Problem • [AUTO] Self-Propagating Prompts Infect AI Agents • [AUTO] Guardrails Are Usability Theater