AI IDE漏洞評測：Kiro等15款AI編碼工具中鏢 | AI IDE Vulnerability Review: Kiro Among 15 Tools Hit

By Kit 小克 | AI Tool Observer | 2026-08-29

🇹🇼 AI IDE漏洞評測：Kiro等15款AI編碼工具中鏢

如果你正在用AI IDE(AI整合開發環境)寫程式碼,這則新聞值得停下來看:資安研究機構Mindgard揭露亞馬遜Kiro存在提示注入漏洞,攻擊者不需要你貼任何惡意指令,光是打開一個惡意工作區資料夾、傳一句話給AI助理,就能讓你的原始碼、憑證等敏感資料被偷偷送到駭客伺服器。而且Kiro不是特例 — 同一批研究人員測試了15款主流AI IDE,總共挖出37個漏洞。

Kiro怎麼被攻破的:四個無害動作串成一條攻擊鏈

這次揭露的提示注入攻擊手法很典型,卻也很難防:

惡意工作區:攻擊者刻意用特殊命名的資料夾,誘使Kiro索引工作區時讀到藏有指令的index.md檔案
零點擊觸發:使用者完全不需要引用惡意內容,只要打開專案、隨便傳一句訊息給AI助理就會中招
竄改設定檔:AI代理被誘導把敏感資訊寫進本機設定檔
外洩:Kiro的其他功能(Kiro Powers)接著把設定檔內容轉換成對外的網路請求,資料就這樣流出去

單獨看每一步都很無害 — 讀檔、寫設定、發request,沒有一步會觸發防毒軟體的警報,組合起來卻等於一條完整的資料外洩鏈。亞馬遜已經在Kiro 0.8.140版修補此問題,官方回應「揭露後不久即已處理」,建議所有用戶更新到最新版。值得一提的是,今年稍早Kiro還被抓到另一個更嚴重的漏洞(CVE-2026-10591,CVSS 8.8分):透過在網頁裡藏白底白字的隱形指令,誘導Kiro改寫MCP設定檔,達成遠端程式碼執行。

不只Kiro:15款AI IDE、37個漏洞,問題是架構性的

Mindgard今年稍早的研究把戰場拉大到Google Gemini CLI、OpenAI Codex、Anthropic Claude Code、Cursor等主流AI IDE,結果找到四種重複出現的漏洞模式:設定檔一載入就自動執行程式碼、初始化階段搶在使用者按下確認鍵之前完成攻擊、指令藏在資料夾名稱裡誘導AI代理跟著做,以及「一次信任、永遠信任」讓後續竄改繞過再驗證。研究人員的結論很直白:「當你給LLM一個shell,等於把王國的鑰匙也給了它」,光靠彈出視窗要求使用者確認,擋不住這類攻擊。

給開發者的建議:別把AI IDE當成無害工具

這次事件的重點不是「Kiro很爛」,而是所有AI編碼助手目前的信任模型都還沒跟上它們被賦予的權限。實務建議:

AI IDE盡量在容器或拋棄式虛擬機裡跑,不要直接連本機檔案系統與憑證
打開來路不明的專案前,先看有沒有可疑的隱藏設定檔或超長資料夾名稱
定期更新AI IDE版本 — 這次漏洞已修補,但下一個隨時可能出現

好不好用,試了才知道。

🇺🇸 AI IDE Vulnerability Review: Kiro Among 15 Tools Hit

If you are writing code with an AI IDE these days, this one is worth pausing for: security firm Mindgard disclosed a prompt injection flaw in Amazon Kiro that lets attackers exfiltrate your source code and credentials without you ever pasting a malicious prompt. Just opening a booby-trapped workspace folder and sending any message to the AI agent is enough. And Kiro is not alone — the same researchers tested 15 mainstream AI IDEs and found 37 vulnerabilities total.

How Kiro Got Compromised: Four Harmless Steps, One Attack Chain

The disclosed prompt injection technique is textbook — and hard to defend against precisely because each step looks innocent:

Malicious workspace: attackers craft a specially-named directory so Kiro reads a hidden index.md file loaded with instructions while indexing the workspace
Zero-click trigger: the user never has to reference the malicious content — opening the project and sending any message is enough
Config tampering: the agent is tricked into writing sensitive local data into a security-relevant config file
Exfiltration: other Kiro features (Kiro Powers) then convert that config into outbound network requests

None of the individual steps trip an antivirus alert — reading a file, writing a config, making a request. Chained together, they form a complete data-exfiltration path. Amazon patched this in Kiro 0.8.140, saying it addressed the finding shortly after it was reported, and recommends updating immediately. Worth noting: Kiro was hit earlier this year by an even more serious bug (CVE-2026-10591, CVSS 8.8) — invisible white-text-on-white instructions on a webpage tricked the agent into rewriting its MCP config for full remote code execution.

Not Just Kiro: 37 Bugs Across 15 AI IDEs Point to a Structural Problem

Mindgards broader audit earlier this year covered Google Gemini CLI, OpenAI Codex, Anthropic Claude Code, Cursor, and more mainstream AI IDEs, and found four recurring vulnerability patterns: config files that auto-execute on load, initialization race conditions that fire before trust dialogs even appear, adversarial instructions hidden in directory names, and trust-once-trust-forever logic that lets later tampering skip re-validation. The researchers verdict is blunt: if you give an LLM a shell, you are giving it the keys to the kingdom — permission popups alone do not stop this class of attack.

What This Means for Developers

The takeaway is not that Kiro is uniquely bad — it is that the trust model behind every AI coding assistant has not caught up with the permissions we have handed it. Practical steps:

Run AI IDEs in containers or disposable VMs instead of connecting them directly to your real filesystem and credentials
Before opening an unfamiliar repo, check for suspicious hidden config files or oddly long directory names
Keep your AI IDE updated — this bug is patched, but the next one is likely already out there

好不好用,試了才知道。 (Only trying it tells you if it is actually good.)

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士