{"data":{"id":"6e776283-44c4-4088-80db-7d038e08e49d","title":"CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration","summary":"Kiro IDE (an AI-assisted development environment) had a vulnerability where an AI agent could modify workspace settings files in untrusted repositories, potentially redirecting the Powers panel (a UI component for extensions) to send sensitive workspace data to external servers. Although users were shown a prompt asking for approval, the malicious settings were already written to disk, so opening the Powers panel before responding would trigger the data leak.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/","publishedAt":"2026-09-11T19:08:25.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Kiro IDE"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-11T19:08:25.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}