Amazon Q Developer and Kiro – Prompt Injection Issues in Kiro and Q IDE plugins

Summary

AWS published bulletin AWS-2025-019 on prompt injection issues in Amazon Q Developer and Kiro, reported in Embrace The Red's "The Month of AI Bugs" blog posts. The Amazon Q Developer flaws, affecting find, grep and echo commands (versions below 1.22.0) and ping and dig commands (versions below 1.24.0), could run commands or exfiltrate metadata via DNS without Human-in-the-Loop confirmation. The Kiro flaw requires local system access and can lead to arbitrary code execution via IDE or MCP settings files, in Autopilot or Supervised mode, affecting version 0.1.42.

Mitigation

Amazon Q Developer Language Server v1.22.0 (released July 17, 2025) requires HITL confirmation for find, grep and echo commands. Language Server v1.24.0 (released July 29, 2025) requires HITL confirmation for ping and dig commands. Kiro version 0.1.42 (released August 1, 2025) requires HITL confirmation for these actions when configured in Supervised mode. AWS also recommends that customers evaluate and implement appropriate security controls and policies for their environments.

Topics

• Prompt injection and jailbreaks

Related items

• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database