# Amazon's Kiro AI Got Its First Real Security Test — And Prompt Injection Won
Amazon shipped Kiro — its agentic coding assistant — with a feature set designed to make developers more productive. "Kiro Powers" are the engine of that ambition: autonomous hooks, spec-driven file operations, the ability to read across your project and act on what it finds. Researchers have now confirmed what security engineers have been warning about since the first agentic AI tool shipped: give a language model real capabilities, and prompt injection becomes a data exfiltration primitive.
The attack is conceptually simple, which is exactly what makes it dangerous at scale. An adversary embeds crafted instructions inside content the AI will read — a malicious README, a dependency's documentation, a poisoned code comment. When Kiro processes that content, it follows the embedded instructions as if they came from the developer. The "Powers" that were meant to help you refactor a codebase become the mechanism for reading secrets and shipping them out.
## Why Kiro Powers Changes the Threat Model
Most prompt injection discussions live in chatbot territory: trick the assistant into saying something it shouldn't. That's bad, but it's mostly a reputational and content-policy problem. Kiro is different. This is an agentic system with hooks that fire on file changes, access to your project's full context, and the ability to execute tasks without explicit per-action approval.
That combination — broad read access, event-driven triggers, and trusted execution — is a qualitatively different attack surface. A successful injection doesn't just produce bad output. It can silently chain through legitimate capabilities: read your .env file, compose the contents into an innocuous-looking API call, and send it somewhere you didn't authorize. The model never "knows" it's doing something wrong. It received an instruction and followed it.
This is the indirect prompt injection model that researchers like Johann Rehberger have been documenting since 2023, but it lands differently when the target is an IDE assistant with filesystem access rather than a web-browsing chatbot.
## The "Powers" Design Is the Attack Surface
Kiro's spec and hook system is architecturally elegant: you define what you want the AI to do, and it fires autonomously when conditions are met. That's also precisely what makes it dangerous when combined with untrusted content. Most coding environments treat files in your project as trusted by default. If you've pulled in a third-party library, cloned a repo, or opened a client's codebase, any content those files contain is now inside Kiro's context — with no meaningful trust boundary separating "instructions from the developer" from "text the developer's code happens to contain."
GitHub Copilot, Cursor, and Codeium have all faced versions of this. The pattern is consistent: AI tools expand capabilities without expanding their threat model to account for adversarial inputs inside trusted contexts. What's new with Kiro is that Amazon is explicitly marketing the agentic autonomy — the "fire and forget" hooks — as a selling point. The same feature that makes it useful makes it a higher-value target.
## What a Real Attack Chain Looks Like
Walk through the mechanics:
1. An attacker contributes to an open-source dependency you use, embedding prompt injection payload in documentation or source comments
2. Your project pulls the dependency; Kiro's indexing reads it as project context
3. A hook fires — say, on file save during a refactor — and Kiro processes the injected payload as instructions
4. The payload instructs Kiro to read ~/.aws/credentials, process.env, or .env files that are already in its allowed context
5. Those contents get embedded in an outbound request the payload describes as a legitimate action — a telemetry call, an API health check, a log entry
None of this requires exploiting a buffer overflow or bypassing authentication. It exploits trust: the AI trusts that everything in its context is legitimate instruction.
## What Defenders Should Do Right Now
If your team is running Kiro or evaluating it:
Amazon will patch the specific vector researchers identified. The underlying architecture problem is harder to fix.
---
## HackWire Analysis
The Kiro prompt injection finding arrives at a precise moment: Amazon is in an aggressive land-grab for enterprise developer mindshare, competing directly with GitHub Copilot (Microsoft), Gemini Code Assist (Google), and a half-dozen funded startups. Each of those competitors has faced similar research. None of them has solved the fundamental problem.
That's because the fundamental problem isn't a bug — it's a design tension. Agentic AI assistants are valuable precisely because they can operate autonomously across broad context. But "broad context" and "autonomous action" combine into a threat model that traditional software security simply doesn't have good answers for. You can't patch your way out of an architecture that trusts everything it reads.
What concerns me more than this specific Kiro finding is the pace of enterprise adoption. Security teams are still building playbooks for AI-assisted development when the systems they're trying to evaluate are already in production, already indexed against codebases that contain secrets, already running hooks on developer machines. The research community is surfacing these vulnerabilities, but the window between disclosure and exploitation in enterprise environments has never been shorter.
There's a comparison worth making here: early OAuth deployments, where the capability shipped widely before the threat model was understood, and enterprises spent years cleaning up redirect-based attacks they'd provisioned themselves. AI coding assistants may be on a similar trajectory — genuinely useful technology deployed at scale before the security community figured out what "secure deployment" actually means for this category.
For now: treat every agentic AI tool in your environment as a high-value target, scope its permissions aggressively, and assume that any content it reads is potentially adversarial. That's a conservative posture. It's also the right one.
— HackWire Editorial
---
## Related Coverage