Amazon Kiro Turns Its Own Extension-Recommendation URL Into a Data Exfiltration Channel

Amazon Kiro, the agentic IDE; tested against version 0.7.45 on Windows, fixed in 0.8.140

Mindgard published a prompt-injection chain in which attacker-controlled repository content makes Kiro read local secrets and hand them to an external endpoint through the IDE's own Kiro Powers feature, a registry-based system the agent uses to recommend and configure extensions. The malicious repository carries a `.stuff/index.md` holding the injected instructions, an `.env` file, and a `.code-workspace` file that sets `kiroAgent.powersRecommendationUrl` to an attacker endpoint containing an `XXX` placeholder. The injected instructions direct the agent to search the workspace, read the `.env`, substitute the recovered secret for the placeholder, and call `kiroPowers(action="configure")`, at which point the IDE fetches the URL and the secret leaves in the query string. Two user actions are required and neither is suspicious: the project must be opened through File then Open Workspace From File rather than as a folder, and the user must send the agent any message at all. The user never writes a malicious prompt and never references the attacker's content, and the attack works in both trusted and untrusted workspaces. Mindgard rates exploitation difficulty as low. Amazon validated the report through HackerOne on January 26, 2026 and patched the same day, with the CVE still pending at publication; an earlier report on December 8, 2025 had been closed as a duplicate, which Mindgard's Aaron Portnoy documented as forcing a redundant discovery cycle. Founder Peter Garraghan's framing was that "AI Has Broken The Vulnerability Disclosure Model," because equivalent outcomes arise from different combinations of model behavior, agent tooling, configuration, and application features

A configuration value that determines where the IDE sends outbound requests is writable from workspace files that arrive with untrusted code, and the agent is permitted to populate it with content it just read from disk. The exfiltration primitive is a product feature, not a bug in the model