The Repository Was Data. Amazon Kiro Treated It as Instructions.
A crafted workspace could steer Amazon Kiro into reading local data and triggering its transmission without a malicious prompt from the user. Amazon fixed the issue in Kiro IDE 0.8.140, but the research exposes a broader trust problem for AI coding agents.
Security researchers found that opening a specially prepared project in Amazon Kiro could turn repository content into instructions for the AI coding agent. Once the user sent any message to the agent, the poisoned workspace could influence Kiro to read sensitive local information and place it into configuration that caused an outbound connection.
The user did not need to ask Kiro to access secrets. The attack was instead embedded in files and settings that looked like ordinary project context. Amazon validated the report and fixed the issue in Kiro IDE 0.8.140.
The repository crossed from data into authority
Kiro is designed to understand and act on a software project. That requires it to read repository files, instructions, workspace configuration and tools associated with the project. The same context that makes the agent useful can also become an attack surface when untrusted content is allowed to shape the agent’s behaviour.
Mindgard researcher Fergal Glynn reproduced the issue in Kiro IDE 0.7.45 on Windows. The tested path required the victim to open a crafted project using File > Open Workspace From File and then send any message to the agent. The finding was reproduced in both trusted and untrusted workspaces.
In the demonstrated chain, attacker-controlled repository content influenced the agent, the agent read information available in the local workspace, and the resulting data was written into security-relevant IDE configuration. A subsequent IDE capability converted that configuration into an outbound request.
The important boundary failure is not simply that a model followed a bad instruction. It is that content supplied by a repository could influence an agent with access to local files and tools, while a separate trusted capability provided a route for the result to leave the machine.
Kiro Powers increased the available context
The research focused in part on Kiro Powers. A Power can bundle Model Context Protocol server settings, steering files such as POWER.md, hooks and other context used by the agent. These features help teams package reusable development workflows, but they also increase the amount of project-controlled material that can affect agent decisions.
The new finding followed an earlier Mindgard report in which a Markdown image request could be used as an exfiltration channel. The later technique used a different path and showed why closing one output mechanism does not resolve the underlying problem. If untrusted content can direct a privileged agent, defenders must evaluate every capability that can read, transform, write or transmit data.
No evidence of malicious exploitation
Mindgard reported the issue through HackerOne. The initial submission was classified as a duplicate, after which the researchers developed a second path and reported it again. Amazon then confirmed the fix in version 0.8.140.
There is no CVE assigned to this specific issue and no evidence in the published research that attackers exploited it maliciously. The disclosure is still operationally relevant because source repositories and starter projects are routinely cloned from third parties, shared between teams and opened before every file has been reviewed.
What Kiro users should do
- Update Kiro. Use version 0.8.140 or later. The current release is newer, so fully updated installations should already contain the fix.
- Treat workspaces as untrusted input. Review workspace files, agent instructions, Powers, hooks and MCP configuration before opening an unfamiliar project.
- Limit agent access. Keep credentials out of broadly readable files and avoid exposing unrelated directories to an agent session.
- Restrict outbound traffic. Network controls can limit exfiltration even when an agent or IDE feature is manipulated.
- Watch configuration changes. Alert on unexpected modifications to workspace settings, MCP server definitions, hooks and URLs that can trigger external requests.
The wider lesson for AI coding tools
Prompt injection becomes more serious when an AI system can take actions. A coding agent may read source files, invoke tools, modify configuration and access credentials intended for development. Each permission can be reasonable in isolation, while the chain between them creates an exfiltration path.
Developers should not have to decide whether every line in a newly opened repository is safe instruction text. AI coding tools need a hard separation between content the model may analyse and instructions it is allowed to trust. They also need visible approval boundaries before sensitive reads or outbound actions occur.
Mindgard first published the research on 14 August 2026 and updated it on 27 August. The source provides dates but no publication times.
