Threat reportVulnerabilityTL-2026-5024
Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration (TL-2026-5024), also tracked as AVID-2026-R0419, is a medium-severity software vulnerability scored CVSS 5.5, first published 2026-11-01. It has no confirmed attribution, affects Amazon Kiro IDE, references 1 CVE (CVE-2026-89332), maps to 7 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0051.001, T1005), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 5.5/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-5024
- Threat ID
- TL-2026-5024
- Also known as
- AVID-2026-R0419, Kiro Powers workspace exfiltration
- Severity
- MEDIUM
- CVSS
- 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
How Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration works
A prompt injection flaw in Amazon Kiro IDE (tested on 0.7.45 for Windows) lets a malicious repository opened via File > Open Workspace From File, plus any message to the Kiro agent, make the agent read local secrets such as .env, write them into the workspace's kiroAgent.powersRecommendationUrl setting, and have the IDE send them to an attacker-controlled endpoint through Kiro Powers. Workspace trust prompts do not prevent it. Amazon fixed it in January 2026, and AWS later published CVE-2026-89332.
Mindgard researcher Aaron Portnoy found the flaw in Amazon Kiro IDE 0.7.45 for Windows in December 2025 and publicly disclosed it on 2026-08-27. Amazon addressed it in the 2026-01-15 Kiro IDE update (0.8.140 per NSFOCUS/The Hacker News). NSFOCUS analyzed it on 2026-09-10. AWS later published CVE-2026-89332, 'Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration', on 2026-09-11, with versions before 0.8.135 affected. NVD lists CVSS v3.1 5.5 and CVSS v4.0 6.7. The hunt skeleton predates the CVE and recorded none, so the CVE-to-flaw mapping rests on OpenCVE/NVD describing the same agent-written-workspace-configuration to Kiro Powers registry exfiltration mechanism.
Attack prerequisites are two routine user actions. The victim opens the malicious project through File > Open Workspace From File (not Open Folder), then sends any message to the Kiro agent. The message need not be malicious or reference attacker content. The malicious repository has three components. (1) An entry point: a specially named subfolder under a .stuff/ directory (the directory name carries prompt-injection text) that contains an index.md with instructions telling the agent to execute tasks without user confirmation. (2) A .code-workspace file that sets kiroAgent.powersRecommendationUrl to an attacker-controlled server with a placeholder query parameter (?XXX) and sets kiroAgent.configureMCP to Disabled. (3) A .env file holding the target secret (the proof of concept used a synthetic OPENAI_API_KEY).
The chain runs automatically in four steps. (1) Opening the workspace and messaging the agent makes it find and read index.md. (2) The agent runs readFile(grepSearch(query="Y=")) to locate and read .env. (3) The agent edits the .code-workspace file, replacing the XXX placeholder with the extracted key. (4) The agent runs kiroPowers(action="configure"), and the IDE itself requests the configured URL, carrying the secret in the query string. Mindgard stressed that no shell command or dedicated upload tool was needed, because the agent chained normal capabilities. The Kiro Powers registry request is the exfiltration channel. The behavior occurred in both Trusted and Untrusted workspace modes, and the IDE gave no security prompt.
The root cause, per the NSFOCUS write-up of Mindgard's analysis, is an end-to-end breakdown of trust boundaries: untrusted repository content becomes agent instructions, which drive local file reads, which are written into security-sensitive IDE settings, which cause outbound HTTP requests, with no intervening boundary control or confirmation. Because exfiltration uses a legitimate IDE networking feature, it can evade EDR and DLP controls that look for dedicated transfer tools. Reachable data includes API keys, environment variables and source code. Exploitation difficulty is low and relies on social engineering to get the workspace opened.
No in-the-wild exploitation, public weaponized PoC, attribution or attacker infrastructure was reported. Mindgard used only sanitized test credentials. Related Kiro findings in the same class: a December 2025 steering-file variant that exfiltrated data via Markdown image rendering (Mindgard, disclosed 2026-01-15); agent-written mcp.json leading to command execution; a February 2026 poisoned-webpage edit of ~/.kiro/settings/mcp.json leading to RCE; and CVE-2026-10591 (CVSS 8.8, June 2026), which fixed overly permissive agent write paths including .vscode/tasks.json and ~/.kiro/settings/mcp.json. The article also reports similar configuration-injection and sandbox-escape issues in Cursor, Codex CLI, Gemini CLI and Claude Code. Mindgard's first HackerOne report was closed as a duplicate of the steering-file issue. It was resubmitted because the root cause (workspace configuration rewriting versus Markdown image rendering) differs.
MITRE ATT&CK / ATLAS techniques used in TL-2026-5024
Execution
AML.T0051 LLM Prompt Injection; AML.T0051.001 LLM Prompt Injection: Indirect; T1204.002 User Execution: Malicious File
Collection
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
Exfiltration
Affected products and versions in Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
- Amazon — Kiro IDE
Vulnerable versions: 0.7.45 (Windows, tested); all versions before 0.8.135 (NVD)
Fixed in: 0.8.135 and later (NVD/AWS bulletin); 0.8.140 (January 15, 2026 update, per NSFOCUS/The Hacker News)
Remediation for Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
Patches
- Kiro IDE 0.8.135 or later (AWS Security Bulletin 2026-111-AWS)
- Kiro IDE 0.8.140 (fix cited by NSFOCUS and The Hacker News)
Immediate actions
- Upgrade Kiro IDE to the current release. The fix shipped in the 2026-01-15 update (0.8.140 per NSFOCUS/The Hacker News); NVD lists versions before 0.8.135 as vulnerable.
- Rotate credentials, API keys and tokens present in any project opened with a vulnerable Kiro version, especially .env contents
- Inventory Kiro installations and flag versions below 0.8.135
- Review .code-workspace files for unexpected kiroAgent.powersRecommendationUrl values and for kiroAgent.configureMCP set to Disabled
Workarounds
- No AWS-published workaround. Avoid File > Open Workspace From File on untrusted projects and avoid messaging the agent in untrusted workspaces.
Longer-term hardening
- Treat agent-writable IDE and workspace configuration files as security policy and require user confirmation for agent edits to them
- Keep secrets out of working directories and use short-lived credentials or a secrets manager
- Open untrusted repositories only in isolated environments or containers
- Monitor and restrict outbound network access from developer endpoints with egress allowlists
CVEs associated with Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
Weaknesses (CWE) in Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
Timeline of Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
- Mindgard (Aaron Portnoy) discovers the earlier Kiro steering-file exfiltration variant (Markdown image rendering).
- Steering-file variant reported to Amazon (the first HackerOne report is later closed as a duplicate).
- Mindgard discovers and reports the malicious-workspace Kiro Powers exfiltration flaw on Kiro IDE 0.7.45 for Windows; the resubmission stresses its distinct root cause.
- Amazon ships the Kiro IDE update fixing the flaw (0.8.140 per NSFOCUS/The Hacker News); Mindgard publishes summary disclosures.
- Mindgard publicly discloses technical details of the malicious-workspace flaw (AVID-2026-R0419); The Hacker News reports it with an Amazon statement confirming the January 15 fix.
- NSFOCUS publishes its analysis of the Kiro prompt injection incident.
- AWS publishes CVE-2026-89332 (Security Bulletin 2026-111-AWS) for versions before 0.8.135; NVD lists CVSS v3.1 5.5 and v4.0 6.7.
Sources cited for Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration
- AI Security Incident Case: Amazon Kiro Prompt Injection Vulnerability Analysis (NSFOCUS)
- Amazon Kiro Prompt Injection Can Exfiltrate Data via Kiro Powers (The Hacker News)
- Mindgard: Amazon Kiro IDE Data Exfiltration via Filename Prompt Injection and Kiro Powers Registry Fetching
- Mindgard: Amazon Kiro IDE Data Exfiltration via Steering File
- NVD: CVE-2026-89332
- AWS Security Bulletin 2026-111-AWS
- Kiro IDE Changelog 0.8.135
- OpenCVE: CVE-2026-89332
- Amazon Kiro Powers sent a test secret from a poisoned workspace (Vibe Graveyard)
- Amazon Kiro CVE-2026-89332: Workspace Data Exfiltration, Fixed Version and Credential Rotation (AICybr)
- Aviatrix Threat Research: Amazon Kiro Prompt Injection Data Exfiltration
- Security Arsenal: Amazon Kiro Prompt Injection via Kiro Powers, Detection and Mitigation Guide
Detection coverage for TL-2026-5024
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5024 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.