AI IDE Prompt Injection Enables Silent Data Exfiltration in Amazon Kiro
A prompt injection vulnerability in Amazon Kiro's AI-powered IDE allowed attackers to abuse 'Kiro Powers' — automated AI agent capabilities — to silently exfiltrate sensitive local data to external endpoints simply by tricking a user into opening a malicious project. The root issue lies in insufficient input sanitization and lack of user-consent guardrails around AI agent actions that interact with the local environment. This matters because AI-integrated development tools are rapidly becoming high-value attack surfaces, and developers often trust their IDE environment implicitly, making them prime targets for supply-chain-style social engineering. Amazon has patched the issue in version 0.8.140, but the incident underscores the broader risk of agentic AI systems executing privileged actions without explicit human approval.
Tactical Insight
Immediate actions
- Upgrade all Amazon Kiro installations to version 0.8.140 or later immediately to remediate the known vulnerability.
- Audit developer workstations for any recently opened third-party or untrusted Kiro projects that may have triggered exfiltration.
- Block or monitor outbound traffic from developer machines to unexpected external endpoints using egress filtering.
Long-term improvements
- Establish explicit allow-lists and user-consent prompts for any AI agent action that reads local files or makes external network calls.
- Implement a secure code review and vetting process before developers open external or community-sourced AI IDE projects.
- Integrate AI development tools into your vulnerability management program to ensure timely patching as new versions release.
Detection measures
- Deploy endpoint DLP (Data Loss Prevention) controls to alert on unexpected file reads combined with outbound data transfers from IDE processes.
- Enable detailed logging of AI agent actions within the IDE and ship logs to a centralized SIEM for anomaly detection.
- Monitor DNS and network telemetry for unusual external connections originating from developer workstation IDE processes.