Amazon Q Developer and Kiro · Prompt Injection Issues in Kiro and Q IDE plugins
Source AWS Security Bulletins
Fixed in 1.24.0 : patch affected systems soon.
Data as of 20 Aug 2026, 17:19 UTC
Rated High by Threat Radar from the AWS Security Bulletins text
- Patch
- Available – fixed in 1.24.0, 1.22.0
What to do
AI-suggested
AWS has released patches that require Human-in-the-Loop (HITL) confirmation for the affected commands and actions: Language Server v1.22.0 (for find, grep, echo), Language Server v1.24.0 (for ping, dig), and Kiro version 0.1.42 (for arbitrary code execution in supervised mode). Users should upgrade to these versions or later and restart the plugins or applications to enforce HITL protections. After upgrading, these commands and actions cannot be executed without explicit developer confirmation, mitigating the risk. No further immediate action is required beyond applying these updates and configuring supervised mode where applicable.
Description
Bulletin ID: AWS-2025-019 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/10/07 01:30 PM PDT Description: We are aware of blog posts by Embrace The Red (“The Month of AI Bugs”) describing prompt injection issues in Amazon Q Developer and Kiro. Amazon Q Developer: Remote Code Execution with Prompt Injection” and “Amazon Q Developer for VS Code Vulnerable to Invisible Prompt Injection. These issues require an open chat session and intentional access to a malicious file using commands such as find, grep, or echo, which could be executed without Human-in-the-Loop (HITL) confirmation. In some cases, invisible control characters could obfuscate these commands. On July 17, 2025, we released Language Server v1.22.0, which requires HITL confirmation for these commands Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection. This issue requires a developer to accept a prompt-injected suggestion including commands such as ping or dig, which could exfiltrate metadata via DNS queries without HITL confirmation. On July 29, 2025, we released Language Server v1.24.0, which requires HITL confirmation for these commands. AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection. This issue requires local system access to inject instructions that lead to arbitrary code execution via Kiro IDE or MCP settings files without HITL confirmation in either Kiro's Autopilot or Supervised mode. On August 1, 2025, we released Kiro version 0.1.42, which requires HITL confirmation for these actions when configured in Supervised mode. Amazon Q Developer and Kiro are built on the principles of agentic development, enabling developers to work more efficiently with the help of AI agents. As customers adopt AI-enhanced development workflows, we recommend they evaluate and implement appropriate security controls and policies based on their specific environments and shared responsibility models (AWS, Amazon Q, Kiro). Amazon Q Developer and Kiro provide safeguards, including Human-in-the-Loop protections and customizable execution policies, to support secure adoption. Affected versions: Amazon Q Developer for find, grep, echo (version <1.22.0) Amazon Q Developer for ping, dig: (versions <1.24.0) AWS Kiro: version 0.1.42