A newly disclosed prompt injection vulnerability in Amazon Kiro, an AI-powered integrated development environment (IDE), could allow attackers to silently exfiltrate sensitive host data by exploiting the platform’s autonomous coding features. According to findings from cybersecurity firm Mindguard, the flaw targets Kiro IDE version 0.7.45 on Windows and currently lacks a Common Vulnerabilities and Exposures (CVE) identifier, leaving security teams without standardised tracking or risk-scoring mechanisms.
The vulnerability stems from Kiro’s “Kiro Powers” architecture, which operates with elevated system privileges rather than within the tightly restricted sandboxes typical of conventional IDE extensions. Mindguard’s analysis indicates that a carefully crafted prompt injection can bypass input validation, effectively collapsing the boundary between AI-assisted code generation and host-level execution. Rather than merely disrupting a developer’s workflow, a successful exploit grants attackers direct read access to local configuration files, credentials, and proprietary source code, enabling seamless data exfiltration to external endpoints.
The absence of a CVE identifier underscores a growing disconnect between legacy vulnerability management frameworks and AI-native threats. Traditional patch cycles and risk-scoring models are ill-equipped to categorise prompt-based exploits, leaving security operations without standardised tracking or cross-vendor coordination. As development environments transition from passive editors to autonomous agents capable of executing system commands, organisations must formally reclassify these AI-driven IDEs as high-privilege infrastructure dependencies rather than benign productivity tools.
Until Amazon releases an official patch or formal advisory, security and engineering teams must deploy immediate compensating controls. Recommended mitigations include blocking outbound network traffic from the IDE, enforcing strict least-privilege execution policies for AI-related processes, and isolating agent-based workflows within containerised or virtualised environments. Additionally, endpoint telemetry should be configured to flag anomalous file access patterns or unexpected network transfers, providing early warning of active injection attempts.
This incident demands a broader security posture shift. AI coding assistants should be integrated into zero-trust architectures, with prompt sanitisation and output validation embedded directly into CI/CD pipelines to establish baseline defences against malformed instructions. The discovery also raises critical operational questions: How should enterprises formally track and prioritise AI-specific vulnerabilities that bypass traditional CVE frameworks? What vendor-agnostic standards will emerge to enforce execution boundaries across autonomous development platforms? Until industry working groups and regulatory bodies establish clear guidelines, security teams must treat these tools as potential attack vectors. For engineering teams managing regulated environments, the Kiro vulnerability reinforces the necessity of strict operational boundaries, proactive network segmentation, and continuous monitoring around emerging AI tooling.
近日披露的 Amazon Kiro（一款由 AI 驅動的整合開發環境）提示詞注入漏洞，可能讓攻擊者利用該平台的自主編碼功能，暗中將敏感的主機數據外洩。根據網絡安全公司 Mindguard 的研究發現，此漏洞針對 Windows 平台的 Kiro IDE 0.7.45 版本，且目前尚未獲分配通用漏洞披露（CVE）編號，致使安全團隊缺乏標準化的追蹤或風險評分機制。
該漏洞源於 Kiro 的「Kiro Powers」架構，其運作時具備較高系統權限，而非受限於傳統 IDE 擴充功能常見的嚴格沙盒環境。Mindguard 的分析指出，精心構造的提示詞注入可繞過輸入驗證，實質上打破了 AI 輔助程式碼生成與主機層級執行之間的界線。成功利用此漏洞不僅會干擾開發人員的工作流程，更會賦予攻擊者直接讀取本地設定檔、憑證及專有原始碼的權限，從而將數據無縫外洩至外部端點。
缺乏 CVE 編號凸顯了傳統漏洞管理框架與 AI 原生威脅之間日益加劇的脫節。傳統的修補週期與風險評分模型難以妥善分類基於提示詞的攻擊手法，致使安全營運團隊缺乏標準化追蹤或跨供應商協調機制。隨著開發環境從被動編輯器轉型為能夠執行系統指令的自主代理，企業必須正式將此類 AI 驅動的 IDE 重新歸類為高權限基礎設施依賴項，而非無害的生產力工具。
在 Amazon 發布官方修補程式或正式安全公告前，安全與工程團隊必須立即部署補償控制。建議的緩解方案包括：封鎖 IDE 的對外網絡流量、對 AI 相關進程實施嚴格的最小權限執行策略，以及將代理型工作流程隔離於容器化或虛擬化環境中。此外，應配置端點遙測以標記異常的檔案存取模式或未經預期的網絡傳輸，從而為正在進行的注入攻擊提供早期預警。
此事件要求企業進行更全面的安全防護策略轉型。AI 編碼助手應整合至零信任架構中，並將提示詞淨化與輸出驗證直接嵌入 CI/CD pipeline，以建立針對格式錯誤指令的基礎防禦。此次發現亦引發關鍵的營運問題：企業應如何正式追蹤並優先處理繞過傳統 CVE 框架的 AI 專屬漏洞？未來將出現哪些供應商中立的標準，以在自主開發平台間強制執行操作界線？在行業工作小組與監管機構訂立明確指引前，安全團隊必須將此類工具視為潛在攻擊向量。對於管理受監管環境的工程團隊而言，Kiro 漏洞再次印證了嚴格劃定操作界線、主動實施網絡分段，以及持續監控新興 AI 工具的必要性。