Executive Summary
Security researchers at Mindgard have identified a critical data exfiltration vulnerability in the Amazon Kiro AI-assisted IDE (version 0.7.45). The flaw allows attacker-controlled files within a project repository to provide instructions to the integrated AI agent. When a user opens a malicious workspace and interacts with the agent, the agent can be coerced into reading sensitive local files (such as .env files) and writing that data into the IDE's 'kiroAgent.powersRecommendationUrl' configuration.
Technically, the attack chain leverages 'Kiro Powers' and Model Context Protocol (MCP) server configurations. The agent, following injected instructions, substitutes sensitive data into a URL placeholder and invokes a configuration action that forces the IDE to make a network request to an attacker-controlled endpoint. This vulnerability bypasses 'Trusted Workspace' restrictions, meaning even projects marked as untrusted by the user remain vulnerable if the agent is engaged.
This incident highlights a systemic shift in threat landscapes where AI agents serve as a bridge between untrusted data interpretation and privileged system execution. While Amazon has patched the issue in version 0.8.140, the complexity of the attack chain underscores the need for SOC teams to monitor AI-driven development tools for unusual configuration changes and outbound network activity originating from IDE processes.