Affected Systems
Amazon Kiro IDE version 0.7.45 on Windows. Vulnerability fixed in version 0.8.140. Latest version is 1.0.337. Affects both trusted and untrusted workspaces when malicious workspace files are opened.
Exploitation Status
No CVE assigned. Proof-of-concept demonstrated by Mindguard. Exploitation difficulty assessed as low. No evidence of active exploitation in the wild. Fixed by vendor in version 0.8.140.
Business Impact
Attackers can exfiltrate sensitive local workspace data and files to external endpoints through crafted repository content without explicit user consent. Exploitation requires user to open a malicious workspace file (File → Open Workspace From File) and send any message to the Kiro agent—no malicious prompt needed. This is part of a broader pattern of trust boundary failures in AI-powered development tools where repository-controlled content influences agent behavior and security-sensitive operations.
Urgency
🟠 Within 24 hours
Recommended Actions
- Upgrade Amazon Kiro IDE to version 0.8.140 or later immediately if running version 0.7.45 or earlier
- Educate developers to avoid opening workspace files from untrusted sources; prefer opening folders directly rather than using File → Open Workspace From File
- Review Kiro agent logs and network traffic for unexpected external connections to identify potential data exfiltration attempts
- Implement network egress filtering to restrict AI IDE tools from connecting to unexpected external endpoints
- Audit all AI-powered development tools (Cursor, Copilot CLI, Gemini CLI, Claude Code) for similar prompt injection and trust boundary vulnerabilities