Kiro workspace exfiltration: opening a repo is the attack

Most people still picture prompt injection as someone typing something clever into a chat box. The Amazon Kiro finding that surfaced this week kills that mental model. The user types nothing malicious. The user opens a project and says hello. That's the whole attack.

What actually happened

The Hacker News reported Mindgard's disclosure of a data-exfiltration flaw in Kiro, AWS's agentic IDE. It affects Kiro IDE 0.7.45 on Windows. There is no CVE. Amazon shipped the fix in version 0.8.140, and the current release is 1.0.337 — so if you are current, you are patched.

The chain is short, which is what makes it worth studying. A victim opens an attacker-controlled project through File → Open Workspace From File — not by opening a folder, which behaves differently. Then they send any message at all to the agent. Attacker-controlled content in that workspace does the rest: a crafted steering file instructs the agent to read a local file and render it as a Markdown image pointing at an external server. The browser fetches the image. The data leaves. Mindgard's write-up notes the user never asked Kiro to access or transmit anything, and rated exploitation difficulty low.

The delivery vehicle is Kiro Powers — bundles that carry MCP server configurations, steering files (POWER.md), hooks, and contextual knowledge. Steering files are persistent context: standing instructions that tell the agent which tools exist and when to use them. That is a feature. It is also an unauthenticated instruction channel that travels inside a repository. Mindgard published two related Kiro disclosures, the other covering filename-based injection and Powers registry fetching, and frames the lesson as bigger than one IDE — these bugs emerge from the interaction between model interpretation, application logic, tools, config, and external resources, not from any single component being broken.

Why prompt injection in your IDE matters for your business

Cloning a repo is now code execution with extra steps. Your team pulls client repos, contractor branches, and open-source examples every week. Under an agentic IDE, that content is instruction, not data. The old rule — "don't run untrusted code" — needs a sibling: don't open untrusted repos in an agent that has your filesystem and your credentials.

Markdown image rendering is an exfiltration channel. Any surface where an agent's output gets rendered — chat panes, previews, dashboards, docs — can carry data out in a URL. This is the same primitive that has now shown up across multiple AI tools. If you build agent UIs, block or proxy outbound image and link fetches in agent-rendered content. That's a couple of hours of work and it closes an entire class.

Config files deserve code review. POWER.md, MCP server definitions, hooks, rules files, agent instructions — these are executable policy for your agents, and most teams merge them without reading them. Put them behind the same review gate as source. Diff them on every dependency or template update.

Patch cadence is the whole defense here. 0.7.45 to 1.0.337 is a wide gap. Agentic dev tools ship fast and their security fixes ship inside ordinary releases with no CVE to trigger your scanner. Pin a version, watch the changelog, and update on a schedule instead of waiting for an advisory that may never come.

Sources: The Hacker News, Mindgard.