# Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)

> A prompt injection flaw in Amazon Kiro IDE (tested on 0.7.45 for Windows) lets a malicious repository opened via File > Open Workspace From File, plus any message to the Kiro agent, make the agent read local secrets such as .env, write them into the workspace's kiroAgent.powersRecommendationUrl setting, and have the IDE send them to an attacker-controlled endpoint through Kiro Powers. Workspace trust prompts do not prevent it. Amazon fixed it in January 2026, and AWS later published CVE-2026-89332.

- **Published:** 2026-11-01T17:52:32Z
- **Last reviewed:** 2026-11-01T17:52:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5024
- **ID:** TL-2026-5024
- **Severity:** MEDIUM (CVSS 5.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-89332

## Description

Mindgard researcher Aaron Portnoy found the flaw in Amazon Kiro IDE 0.7.45 for Windows in December 2025 and publicly disclosed it on 2026-08-27. Amazon addressed it in the 2026-01-15 Kiro IDE update (0.8.140 per NSFOCUS/The Hacker News). NSFOCUS analyzed it on 2026-09-10. AWS later published CVE-2026-89332, 'Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration', on 2026-09-11, with versions before 0.8.135 affected. NVD lists CVSS v3.1 5.5 and CVSS v4.0 6.7. The hunt skeleton predates the CVE and recorded none, so the CVE-to-flaw mapping rests on OpenCVE/NVD describing the same agent-written-workspace-configuration to Kiro Powers registry exfiltration mechanism.

Attack prerequisites are two routine user actions. The victim opens the malicious project through File > Open Workspace From File (not Open Folder), then sends any message to the Kiro agent. The message need not be malicious or reference attacker content. The malicious repository has three components. (1) An entry point: a specially named subfolder under a .stuff/ directory (the directory name carries prompt-injection text) that contains an index.md with instructions telling the agent to execute tasks without user confirmation. (2) A .code-workspace file that sets kiroAgent.powersRecommendationUrl to an attacker-controlled server with a placeholder query parameter (?XXX) and sets kiroAgent.configureMCP to Disabled. (3) A .env file holding the target secret (the proof of concept used a synthetic OPENAI_API_KEY).

The chain runs automatically in four steps. (1) Opening the workspace and messaging the agent makes it find and read index.md. (2) The agent runs readFile(grepSearch(query="Y=")) to locate and read .env. (3) The agent edits the .code-workspace file, replacing the XXX placeholder with the extracted key. (4) The agent runs kiroPowers(action="configure"), and the IDE itself requests the configured URL, carrying the secret in the query string. Mindgard stressed that no shell command or dedicated upload tool was needed, because the agent chained normal capabilities. The Kiro Powers registry request is the exfiltration channel. The behavior occurred in both Trusted and Untrusted workspace modes, and the IDE gave no security prompt.

The root cause, per the NSFOCUS write-up of Mindgard's analysis, is an end-to-end breakdown of trust boundaries: untrusted repository content becomes agent instructions, which drive local file reads, which are written into security-sensitive IDE settings, which cause outbound HTTP requests, with no intervening boundary control or confirmation. Because exfiltration uses a legitimate IDE networking feature, it can evade EDR and DLP controls that look for dedicated transfer tools. Reachable data includes API keys, environment variables and source code. Exploitation difficulty is low and relies on social engineering to get the workspace opened.

No in-the-wild exploitation, public weaponized PoC, attribution or attacker infrastructure was reported. Mindgard used only sanitized test credentials. Related Kiro findings in the same class: a December 2025 steering-file variant that exfiltrated data via Markdown image rendering (Mindgard, disclosed 2026-01-15); agent-written mcp.json leading to command execution; a February 2026 poisoned-webpage edit of ~/.kiro/settings/mcp.json leading to RCE; and CVE-2026-10591 (CVSS 8.8, June 2026), which fixed overly permissive agent write paths including .vscode/tasks.json and ~/.kiro/settings/mcp.json. The article also reports similar configuration-injection and sandbox-escape issues in Cursor, Codex CLI, Gemini CLI and Claude Code. Mindgard's first HackerOne report was closed as a duplicate of the steering-file issue. It was resubmitted because the root cause (workspace configuration rewriting versus Markdown image rendering) differs.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1567 Exfiltration Over Web Service
- AML.T0051 LLM Prompt Injection
- AML.T0051.001 LLM Prompt Injection: Indirect

## Sources

- [AI Security Incident Case: Amazon Kiro Prompt Injection Vulnerability Analysis (NSFOCUS)](https://nsfocusglobal.com/ai-security-incident-case-amazon-kiro-prompt-injection-vulnerability-analysis/)
- [Amazon Kiro Prompt Injection Can Exfiltrate Data via Kiro Powers (The Hacker News)](https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html)
- [Mindgard: Amazon Kiro IDE Data Exfiltration via Filename Prompt Injection and Kiro Powers Registry Fetching](https://mindgard.ai/disclosures/amazon-kiro-ide-data-exfiltration-via-filename-prompt-injection-and-kiro-powers-registry-fetching)
- [Mindgard: Amazon Kiro IDE Data Exfiltration via Steering File](https://mindgard.ai/disclosures/amazon-kiro-ide-data-exfiltration-via-steering-file)
- [NVD: CVE-2026-89332](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89332)
- [AWS Security Bulletin 2026-111-AWS](https://aws.amazon.com/security/security-bulletins/2026-111-aws/)
- [Kiro IDE Changelog 0.8.135](https://kiro.dev/changelog/ide/0-8/#patch-0-8-135)
- [OpenCVE: CVE-2026-89332](https://app.opencve.io/cve/CVE-2026-89332)
- [Amazon Kiro Powers sent a test secret from a poisoned workspace (Vibe Graveyard)](https://vibegraveyard.ai/story/amazon-kiro-powers-secret-exfiltration/)
- [Amazon Kiro CVE-2026-89332: Workspace Data Exfiltration, Fixed Version and Credential Rotation (AICybr)](https://aicybr.com/blog/amazon-kiro-cve-2026-89332-workspace-data-exfiltration)
- [Aviatrix Threat Research: Amazon Kiro Prompt Injection Data Exfiltration](https://aviatrix.ai/threat-research-center/amazon-kiro-prompt-injection-data-exfiltration-2026)
- [Security Arsenal: Amazon Kiro Prompt Injection via Kiro Powers, Detection and Mitigation Guide](https://securityarsenal.com/blog/amazon-kiro-prompt-injection-via-kiro-powers-detection-and-mitigation-guide-for-agentic-ide-data-exfiltration)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5024