Amazon Q extension for VS Code ships with an injected prompt to wipe users' systems
An attacker used an inappropriately scoped GitHub token to commit code to the open-source Amazon Q Developer extension for VS Code, and AWS shipped it in version 1.84.0. The code carried a prompt telling the AI agent to wipe the user's home directory and delete their AWS cloud resources, but AWS says it failed to execute because of a syntax error. AWS revoked the credentials, pulled 1.84.0 from distribution and released a clean 1.85.0.
A person claiming responsibility told 404 Media they had submitted a pull request from an account with no existing access, were then given admin credentials, and made the wiper deliberately defective to expose AWS's security practices. The script passed the prompt to the Amazon Q CLI with the --trust-all-tools and --no-interactive arguments, and the compromised version stayed on the VS Code marketplace for about two days.
What would have stopped it
Scope CI tokens to the minimum and require human review of every commit before an automated release ships.
Guardrails
- G1 Least privilege Failed The CodeBuild GitHub token was inappropriately scoped, letting the attacker commit to the extension repository.
- G2 Human confirmation Failed Injected prompt ran the Q CLI with --trust-all-tools and --no-interactive, bypassing user confirmation.
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Failed AWS released the compromised version unaware; it stayed on the marketplace for about two days.
- G8 Recovery Held AWS removed 1.84.0 from distribution channels and released a clean 1.85.0.
Sources
-
“With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.”
-
“A hacker compromised a version of Amazon’s popular AI coding assistant ‘Q’, added commands that told the software to wipe users’ computers, and then Amazon included the unauthorized update in a public release of the assistant this month, 404 Media has learned.”
-
“The official Amazon Q extension for Visual Studio Code (VS Code) was compromised to include a prompt to wipe the user's home directory and delete all their AWS resources.”
-
“Amazon was completely unaware of the breach and published the compromised version, 1.84.0, on the VSC market on July 17, making it available to the entire user base.”
Confidence 96% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 4 sources