Loading story…
Mindgard disclosed a prompt-injection flaw in Amazon Kiro IDE that allowed a malicious repository opened through a workspace file to be treated as agent instructions after a user sent any message. In testing against Kiro 0.7.45 for Windows, the agent could read local secrets, alter workspace configuration, and use Kiro Powers network capabilities to exfiltrate data, reportedly without approval prompts in either trusted or untrusted workspace modes.
The issue stemmed from inadequate trust separation between repository content, agent tool permissions, writable IDE configuration, and outbound network access. Mindgard reported the vulnerability to Amazon in December 2025; Amazon remediated it in January 2026 and shipped the fix in Kiro 0.8.140. The disclosure, alongside reporting on excessive IAM privilege risks in AWS AgentCore deployments, reinforces that AI-agent integrations require strict least-privilege controls and explicit approval gates for secret access and network actions.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Mindgard publicly disclosed the Amazon Kiro IDE prompt-injection vulnerability, describing exfiltration through attacker-controlled workspace configuration and legitimate Kiro Powers network requests. No CVE had been assigned at the time of disclosure.
Amazon patched CVE-2026-10591, a Kiro vulnerability with a CVSS score of 8.8 that permitted writes to sensitive paths including .vscode/tasks.json and ~/.kiro/settings/mcp.json.
Intezer demonstrated that a poisoned webpage could cause Kiro to modify ~/.kiro/settings/mcp.json, leading to remote code execution.
Amazon completed remediation for the reported Kiro prompt-injection vulnerability and released the fix in Kiro version 0.8.140.
Mindgard reported a prompt-injection vulnerability to Amazon in which a malicious Kiro workspace and repository content could steer the agent to read local secrets, alter configuration, and exfiltrate data through Kiro Powers networking.
Mindgard identified an earlier Kiro steering-file variant that could induce the agent to append local file contents to Markdown image URLs for exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple prompt injection flaws in AWS's Kiro IDE that allowed untrusted content to rewrite the tool's own configuration and execute arbitrary code on a developer's machine. One attack showed that prompt injection hidden in source code comments could modify trusted settings such as `.vscode/settings.json` or add malicious Model Context Protocol servers through `~/.kiro/settings/mcp.json`, effectively allowlisting dangerous Bash commands and triggering local program execution without meaningful user consent. A later finding showed a poisoned web page could similarly induce Kiro to overwrite its MCP configuration, automatically reload it, and launch attacker-defined MCP servers with the developer's privileges. AWS patched the issues in subsequent Kiro releases, including fixes reported in `v0.1.42` and confirmation that the web-based attack no longer worked in `v0.11.130`, while adding protected-path enforcement and a capability-based permissions model; no CVE was assigned to the reported flaws.
Jul 22, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026
Microsoft disclosed two critical vulnerabilities in its **Semantic Kernel** AI agent framework that could let prompt injection escalate into host compromise. `CVE-2026-26030` affected the Python implementation before version `1.39.4`, where unsafe `eval()`-based lambda construction in the Search Plugin’s default In-Memory Vector Store filter path enabled remote code execution, while `CVE-2026-25592` affected the .NET SDK before version `1.71.0` and allowed arbitrary file write through `SessionsPythonPlugin`’s `DownloadFileAsync`, creating a path to sandbox escape and host takeover; a related arbitrary file read issue was also present in upload handling. Microsoft said it hardened AST validation, restricted callable functions and attributes, removed unintended tool exposure, added path validation, and urged customers to patch and review endpoint telemetry for signs of exploitation. The disclosure lands amid broader warnings that AI agents can preserve and amplify malicious instructions through memory and context reuse. Cisco researchers recently showed that poisoned memory files in Anthropic’s **Claude Code** could persist across projects and sessions, steering the assistant to insert hard-coded secrets, choose insecure packages and configurations, and spread tainted changes to another developer. Researchers and defenders say the incidents reinforce that AI models are not security boundaries and that any model-influenced tool parameter, memory file, or context artifact should be treated as attacker-controlled input, with mitigations including patching vulnerable frameworks, scanning memory and dependency files, and purging stored agent memory after suspected compromise.
Jun 29, 2026