Cybersecurity experts have uncovered a critical vulnerability in Amazon Kiro, an AI-driven integrated development environment (IDE). This flaw, identified by Mindguard, enables data leaks through prompt injection and Kiro Powers, posing significant security concerns.
Kiro Vulnerability Details
The security gap affects Kiro IDE version 0.7.45 on Windows, with the current version being 1.0.337. The flaw allows external influence over the Kiro agent by manipulating repository content, leading to unauthorized transmission of sensitive data, as reported by Fergal Glynn to The Hacker News.
Kiro Powers, which include Model Context Protocol (MCP) configurations and steering files, play a crucial role in this vulnerability. The steering file acts as a guide, informing the AI agent about available tools and their usage, which attackers can exploit.
Exploitation Mechanism
The vulnerability requires users to load a malicious project via a workspace file and send a message to the agent, enabling data exfiltration without explicit permission. This process can affect both trusted and untrusted workspaces, with low difficulty for exploitation.
The flaw is particularly concerning as it does not require any malicious prompt from the user. Opening a crafted workspace file and sending any message is sufficient to trigger the vulnerability, leading to data leaks.
Broader Implications and Mitigation
This vulnerability highlights a broader issue in AI development environments where models interpret and execute tasks based on repository files, potentially causing trust boundary failures. Amazon addressed this flaw with a fix in Kiro IDE version 0.8.140, following responsible disclosure.
Mindguard previously identified similar vulnerabilities in Kiro, including one that allowed steering-file directives to send local data to external servers through Markdown image requests. These revelations come amidst a series of security challenges in AI tools across various platforms.
Recent vulnerabilities in tools like OpenAI Codex CLI and Microsoft Visual Studio Code showcase the extensive scope of these security risks. These issues emphasize the complexity of AI vulnerabilities, which arise from interactions between model interpretation, application logic, and external resources.
As AI systems evolve, it is crucial for vulnerability disclosure programs to consider these multifaceted execution paths. Understanding these interactions can help mitigate risks and enhance the security of AI-driven environments.
