Amazon Kiro評測：AI IDE提示注入漏洞外洩機密資料 | Amazon Kiro Review: Prompt Injection Leaks Secrets

By Kit 小克 | AI Tool Observer | 2026-09-06

🇹🇼 Amazon Kiro評測：AI IDE提示注入漏洞外洩機密資料

Amazon Kiro是AWS力推的「規格驅動」AI代理式IDE，強調先讓AI寫規格文件、開發者審核後再產生程式碼；但資安研究單位Mindgard最近踢爆，Kiro存在一個嚴重的提示注入（prompt injection）漏洞：攻擊者只要在專案裡放一個看似無害的檔案，使用者開啟工作區並隨口跟AI代理傳一則訊息，機密資料就可能被偷偷送到外部伺服器——使用者完全不需要引用惡意內容，甚至不用打出任何跟攻擊有關的指令。

什麼是Amazon Kiro？

Kiro是AWS在2025年推出、以VS Code為基礎打造的代理式IDE，核心賣點是「規格先行」：開發者用自然語言描述需求，Kiro自動轉成結構化規格文件（EARS格式使用者故事），再由AI依規格產生程式碼、測試與文件。它還內建Hooks自動化機制，能在存檔、開PR等事件觸發時自動跑測試或更新文件，被視為在「vibe coding」之外，更接近正式軟體工程流程的做法。

Kiro提示注入漏洞是怎麼運作的？

簡單說：攻擊者不需要騙使用者輸入惡意指令，只要讓對方打開一個被動過手腳的工作區就夠了。研究人員發現，只要在專案裡埋一個經過設計的「steering」設定檔，等使用者開啟該工作區、對AI代理傳送任意一則訊息，注入的指令就會啟動——命令Kiro讀取本機的機密資料（例如API金鑰、.env檔），接著用Markdown圖片語法把資料拼進一個外部網址，Kiro渲染圖片時就會觸發一次帶著機密資料的對外請求，資料就這樣被偷渡出去。研究單位評估這個攻擊的難度偏低，且不需要CVE編號就足以構成實質風險。

更麻煩的是，這不是單一事件：早在今年七月，就有另一組研究人員揭露過Kiro可能被惡意網頁改寫MCP設定、進而遠端執行程式碼的問題。兩起事件顯示，Kiro這類「代理式IDE」的攻擊面遠比傳統編輯器複雜，能整合的Powers（外掛擴充）愈多，能被濫用的路徑也愈多。

AWS修補了嗎？開發者該怎麼防範？

好消息是，AWS已在Kiro IDE 0.8.140版修補了這個漏洞，如果你還在用0.7.x版本，強烈建議立刻更新。但這起事件真正的教訓是：代理式IDE把「讀檔、執行、連網」全部交給AI自主判斷，等於把信任邊界從「使用者輸入」擴大到「工作區裡的任何一個檔案」。實務上建議：不要隨意開啟不明來源的專案資料夾、定期更新IDE版本、審查steering file與Hooks的內容來源、搭配像GitGuardian這類機密掃描Power把.env擋在外面，並留意AI代理被授予的網路存取權限是否過度寬鬆。

好不好用，試了才知道——但用AI IDE寫程式碼之前，先搞清楚它會替你打開哪些門。

🇺🇸 Amazon Kiro Review: Prompt Injection Leaks Secrets

Amazon Kiro is AWS's flagship "spec-driven" agentic IDE, designed to have AI draft a specification before writing any code. But security researchers at Mindgard recently disclosed a serious prompt injection vulnerability in Kiro: an attacker just needs to plant an innocuous-looking file in a project, and once a developer opens that workspace and sends the AI agent any message at all, sensitive data can be silently exfiltrated to an external server — no malicious prompt required, and the victim never has to reference the tainted content.

What Is Amazon Kiro?

Kiro is AWS's agentic IDE, built on the VS Code (Code OSS) platform and launched in 2025. Its core idea is "spec-first": developers describe requirements in natural language, Kiro turns them into structured EARS-format specs, and only then does the AI generate code, tests, and docs from that spec. Kiro also ships with Hooks, automation triggers that fire on events like file saves or PR opens to run tests or update documentation — positioning it as a step beyond casual "vibe coding" toward something closer to real engineering discipline.

How Does the Kiro Prompt Injection Attack Work?

In short: an attacker doesn't need to trick you into typing a malicious command — they just need you to open a tampered workspace. Researchers found that a crafted "steering" configuration file planted in a repo is enough. Once the victim opens that workspace and sends any message to the agent, the injected instructions activate — telling Kiro to read local secrets (API keys, .env files), stitch that data into a Markdown image URL, and fire off an outbound request the moment Kiro renders the image, smuggling the secret out. Researchers rated the exploit difficulty as low, and it doesn't even carry a CVE number.

Worse, this wasn't an isolated bug: back in July, a separate disclosure showed a malicious webpage could rewrite Kiro's MCP configuration to achieve remote code execution. Together they show that agentic IDEs have a much larger attack surface than traditional editors — the more "Powers" (integrations) you enable, the more paths an attacker has to abuse.

Has AWS Patched It? How Should Developers Protect Themselves?

The good news: AWS shipped a fix in Kiro IDE version 0.8.140. If you're still on 0.7.x, update immediately. But the real lesson is structural — agentic IDEs hand over file reads, code execution, and network access to an AI's judgment, effectively expanding the trust boundary from "what the user typed" to "every file sitting in the workspace." Practical steps: avoid opening unfamiliar project folders, keep Kiro updated, review the source of any steering files or Hooks before trusting them, pair the IDE with a secrets-scanning Power like GitGuardian to keep .env files out of reach, and audit exactly what network access your AI agent has been granted.

好不好用，試了才知道 — but before you let an AI IDE run wild in your codebase, know exactly which doors you're leaving open.

Sources / 資料來源

常見問題 FAQ

Amazon Kiro是什麼？

Kiro是AWS推出的規格驅動AI代理式IDE，讓AI先寫規格文件再產生程式碼，2025年上線，以VS Code為基礎打造。

Kiro的提示注入漏洞有多危險？

攻擊難度低，使用者不需要輸入任何惡意指令，只要開啟被植入惡意檔案的工作區並傳一則訊息，機密資料就可能外洩，目前未取得CVE編號。

這個漏洞修好了嗎？

AWS已在Kiro IDE 0.8.140版修補，仍在使用0.7.x版本的使用者應立即更新。

一般開發者該怎麼防範類似的AI IDE風險？

避免開啟不明來源專案、隨時更新IDE版本、審查steering file與Hooks內容，並搭配機密掃描工具限制AI代理的檔案與網路存取權限。

這是Amazon Kiro獨有的問題嗎？

不算單一個案，同類代理式IDE都面臨類似的提示注入風險，核心問題在於AI被賦予過大的自主讀寫與連網權限。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士