Amazon's Kiro AI Coding Tool Can Be Tricked Into Leaking Your Secrets

Key points

• Researchers at Mindguard disclosed a prompt injection flaw in Amazon Kiro, an AI-powered coding assistant, that can quietly send sensitive files out of a developer's machine.
• The attack was demonstrated against Kiro IDE version 0.7.45 on Windows and does not currently have a CVE identifier.
• The flaw abuses a built-in feature called Kiro Powers, which lets the AI run actions without asking the user first.
• No customer data breach has been reported; the risk is to developers who open a poisoned project or file.

Amazon's new AI coding tool does what it's told, even when the instructions come from someone who shouldn't be giving them.

Security firm Mindguard has disclosed a flaw in Amazon Kiro, an agentic integrated development environment. That's a code editor with a built-in AI assistant that can take actions on the developer's behalf, reading files, writing code, running commands. Think of it as a very eager junior engineer who never asks twice.

The issue, first reported by The Hacker News, affects Kiro IDE 0.7.45 on Windows. It hasn't been assigned a CVE identifier, the standard tracking number used for software flaws.

How does the attack actually work?

An attacker hides instructions inside a file or project that the developer opens in Kiro. The AI reads those instructions as if the user had typed them, then acts on them.

This is prompt injection. The AI can't tell the difference between a genuine request from its owner and text smuggled in through a document or a code snippet. Whatever it reads, it may obey.

Mindguard's proof of concept exploits a feature called Kiro Powers, a set of pre-approved actions the assistant can take without stopping to ask permission each time. Handy for productivity. Also handy for an attacker who wants those same actions triggered silently. The result: files on the developer's machine, potentially including API keys or credentials saved in the project folder, get sent to a location the attacker controls.

This isn't an isolated pattern. Our 4 August story on poisoned AI instruction files found real GitHub examples where configuration files for AI coding assistants were stealing passwords and entire conversations without triggering a single alarm.

Who is at risk?

Developers running the affected build of Kiro on Windows who open untrusted repositories or documents inside the IDE. Ordinary consumers aren't directly exposed.

The wider concern is what this class of flaw means for agentic AI tools generally. These assistants are being sold on their ability to act autonomously. Every autonomous action is a potential attack surface if the input feeding it can be poisoned.

Should you worry?

If you're running Kiro, yes. Update to the latest release as soon as one is available and check Amazon's advisory channel for a fix note. Until then, treat the assistant like a colleague who reads everything out loud and acts on it.

Some practical habits help. Don't open unknown repositories inside an agentic IDE; inspect them in a plain text editor first. Keep secrets out of project folders entirely, using a secrets manager or environment variables loaded from outside the workspace. Watch outbound network activity from developer machines for unexpected destinations.

Regulatory jurisdiction here is thin, because no personal data breach has been reported. If exploited against a company machine holding customer data, US developers would fall under FTC oversight for reasonable security practices. UK and EU developers face the ICO and relevant data protection authorities. Notification duties kick in only once personal data is known to have left the building.

For now, this is a warning shot. Agentic coding tools are shipping faster than the guardrails around them.