Executive brief
Amazon Q Developer and Kiro are AI-powered development tools that help engineers write and manage code. Vulnerabilities in these tools could allow a malicious file or prompt to trick the AI into executing unauthorized commands on a developer's machine, potentially leading to data theft or full system compromise. Attackers could use these flaws to steal sensitive credentials or run malicious software by bypassing the usual manual confirmation steps.
Technical details
Multiple prompt injection vulnerabilities exist in Amazon Q Developer and AWS Kiro IDE plugins. In Amazon Q Developer, indirect prompt injection via malicious files could trigger commands like 'find', 'grep', or 'echo' without Human-in-the-Loop (HITL) confirmation, potentially leading to Remote Code Execution (RCE). Another variant uses 'ping' or 'dig' commands within AI-generated suggestions to exfiltrate metadata via DNS queries. In AWS Kiro, local system access can be used to inject instructions into IDE or MCP settings files, resulting in arbitrary code execution. These vulnerabilities stem from the AI agent's ability to execute system-level commands autonomously. AWS has addressed these by requiring HITL confirmation for sensitive commands in Language Server v1.24.0 and Kiro v0.1.42.
Affected products
- AWS Amazon Q Developer IDE plugin Language Server < 1.24.0
- AWS Kiro IDE application < 0.1.42
Timeline
- 2025-07-17: patched: Language Server v1.22.0 released to address find/grep/echo commands
- 2025-07-29: patched: Language Server v1.24.0 released to address DNS exfiltration commands
- 2025-08-01: patched: Kiro version 0.1.42 released to address arbitrary code execution
- 2025-10-07: advisory: AWS security bulletin published