Amazon Kiro IDE 0.7.45 Allows Workspace-Driven Data Exfiltration Without User Malicious Prompts

The flaw required opening a malicious .code-workspace file via File → Open Workspace From File, then any agent message. Attacker content in POWER.md and MCP server configs crossed trust boundaries by directing the agent to read sensitive workspace data, embed it in configuration writes, and trigger network activity through subsequent IDE capabilities. Exploitation succeeded in both trusted and untrusted workspaces with low difficulty. Mindguard traced the root cause to persistent steering files that override agent behavior across the entire workflow, extending a prior Markdown image exfiltration vector. This mirrors the June 2026 CVE-2026-10591 where crafted instructions rewrote ~/.kiro/settings/mcp.json for arbitrary execution on folder open, showing repeated failure to isolate repository-controlled instructions from security-sensitive paths. The pattern indicates AI IDEs that merge interpretation and execution lack enforceable boundaries when repository files supply context. Amazon patched in 0.8.140 after disclosure, yet the sequence of workspace, steering, and MCP modifications remains a structural risk in agentic tools. Future versions must enforce explicit approval for any config write derived from external content. Independent verification of the Mindguard report against contract and changelog data shows Amazon treated these as isolated fixes rather than redesigning the agent trust model.