Summary
On 2025-10-07, AWS published Security Bulletin AWS-2025-019 about prompt injection issues in the Amazon Q Developer and Kiro IDE plugins. AWS states that the issues were reported by external researchers, including Embrace The Red, HiddenLayer and MaccariTA, through coordinated vulnerability disclosure.
This record is a vendor advisory: the primary evidence is the vendor's own description. It is the first record of this type in the library. The bulletin does not state that the issues were exploited maliciously.
Classification and evidence status
| Field | Value |
|---|---|
| Record type | Vendor advisory |
| Public disclosure | 2025-10-07 |
| Vendor / product | AWS / Amazon Q Developer and Kiro IDE plugins |
| Attack class | Indirect prompt injection |
| Delivery vector | Repository content - untrusted files and IDE or MCP configuration content that the coding agent reads, under preconditions stated by AWS |
| Affected data / capabilities | Commands the IDE agent could run, developer metadata and secrets, and IDE or MCP configuration |
| Demonstrated impact | As described by AWS: commands that could run without confirmation, a metadata exfiltration path that required accepting an injected suggestion, and configuration-based arbitrary code execution in Kiro with stated preconditions |
| In-the-wild status | No in-the-wild exploitation reported in cited sources. The bulletin describes issues reported through coordinated disclosure and does not state exploitation in the wild. |
| Remediation status | Remediated by vendor. According to AWS, Language Server 1.22.0 and 1.24.0 and Kiro 0.1.42 add human-in-the-loop confirmation; AWS recommends Language Server 1.24.0 or later, the latest Amazon Q Developer IDE plugin, or the latest Kiro. |
| Identifiers | Vendor bulletin AWS-2025-019 (AWS Security Bulletin) |
| External score | No external score shown |
Affected system and trust path
An IDE coding agent reads project files and configuration to help with a task, and it can run commands in the developer's environment. File contents and configuration can come from third parties, for example a cloned repository. When such content can influence which commands the agent proposes or runs, it borrows the developer's local authority. The bulletin describes human-in-the-loop confirmation as the control that separates a suggestion from its execution.
High-level attack chain
At a high level, AWS describes three classes, each with its own preconditions:
- After a developer intentionally opens or accesses malicious content, the agent could run certain commands without human-in-the-loop confirmation.
- A separate path could disclose metadata or secrets, but required the developer to accept a suggestion that contained injected content.
- In Kiro, configuration content could lead to arbitrary code execution; AWS states this required local system access and existed in specific agent modes.
This record does not reproduce command names, file contents, obfuscation methods, data transfer techniques or configuration content.
Demonstrated impact vs observed exploitation
Documented by the vendor: the three issue classes above and their preconditions, based on coordinated disclosure reports.
Observed in the wild: not reported in the bulletin. Influencing the agent's suggestion is model influence; the security impact arose where commands or configuration changes could take effect without a separate confirmation step.
Enabling control gaps
- Certain agent-initiated commands could execute without human-in-the-loop confirmation.
- Content from project files and configuration was able to influence the agent's actions in the developer's environment.
- Configuration files that determine agent and tool behavior could be changed in ways that led to code execution under the stated preconditions.
Vendor and researcher response
According to the bulletin, AWS released Language Server 1.22.0 and 1.24.0 for Amazon Q Developer, which require human-in-the-loop confirmation for the affected commands, and Kiro 0.1.42, which requires confirmation for the affected actions when Kiro runs in Supervised mode. AWS recommends upgrading to Language Server 1.24.0 or later, the latest Amazon Q Developer IDE plugin, or the latest Kiro, and recommends that customers evaluate security controls and policies for their environments. The bulletin lists no CVE, and this record does not add one.
Evidence defenders should retain
- Where available, IDE agent action logs showing commands proposed and run, with whether and how they were confirmed.
- Plugin, language server and Kiro version history on developer machines, to establish exposure windows.
- Changes to IDE and MCP configuration files, with the session and content that preceded them.
- Outbound network activity from developer machines that follows agent sessions, including unusual lookups.
- Lineage of files and repositories that entered the agent's context before a sensitive action.
Defensive lessons
- Agent Authorization: treat each command and configuration change as an action checked by application-side policy, not by what the model proposes.
- Human-in-the-Loop: show the exact action for confirmation, and keep approval separate from authorization.
- Least Privilege: restrict which commands, paths and network access an IDE agent can use by default.
- Information Flow Control: limit channels through which local secrets and metadata could leave the developer environment.
Related Learn topics
- AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
- Why Prompt Injection Is Not Just Input Validation - Why classic input validation stays necessary for structured boundaries but cannot decide source trust, instruction authority, authorization or information flow for natural-language content.