Executive Summary
Researchers disclosed a vulnerability in Amazon Kiro, an agentic development environment, where attacker-controlled repository content could steer the agent through prompt injection and send sensitive local information to an external endpoint via Kiro Powers.
What Happened
Researchers disclosed a vulnerability in Amazon Kiro, an agentic AI development environment, where attacker-controlled repository content influenced the agent through prompt injection. The issue could cause sensitive local information to be transmitted to an external endpoint, according to the report.
Affected Products
- Amazon Kiro
Vulnerability / Attack Technique
Indirect prompt injection via repository content leading to data exfiltration
Technical Mechanism
Instructions planted in repository files were read by the Kiro agent, which then used Kiro Powers to transmit local data to an attacker endpoint.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Opening an untrusted repository in an agentic IDE is now a data-exposure event. RealGround analysis: agentic IDEs should not have unrestricted outbound network access while reading untrusted code.
Recommended Controls
- Update Amazon Kiro to the fixed version
- Restrict agentic IDE network egress
- Open untrusted repositories in an isolated environment
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
The Hacker News: https://thehackernews.com/search/label/Application%20Security?m=1&hl=ko_KR
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.