Rank #19 of 35·Security·23 Jul 2025·Amazon Q Developer extension
Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension
“Saved by a typo. Somewhere, a linter is weeping with pride.”
- An over-permissioned GitHub token let an outsider commit to the repo
- A prompt telling the agent to wipe files and AWS resources shipped in v1.84.0
- A syntax error stopped it running; AWS pulled the version and patched it
Someone slipped a 'wipe everything' order into Amazon's AI coding assistant, and Amazon shipped it to users.
What happened
In July 2025 an outsider got write access to the open-source repo behind the Amazon Q Developer extension for VS Code. AWS later blamed a GitHub token in its build setup that had far more access than it needed. The intruder added a prompt telling the AI agent to return the machine to a near-factory state: start in the home folder, then hunt down AWS profiles and delete cloud resources. Nobody noticed the commit, and it went out in version 1.84.0 on 17 July.
The damage
Not much, by luck. AWS says the payload never ran because of a syntax error. The person who claimed responsibility told 404 Media the wiper was meant to be broken, as a warning about Amazon's security. AWS pulled 1.84.0, released a clean 1.85.0 and told everyone to remove the bad version.
How it was caught, and what happened next
The timeline is what makes it sting. The person behind it told 404 Media they opened a pull request at the end of June from a random account with no access, and got admin credentials "on a silver platter." The prompt went in on 13 July, and Amazon shipped it four days later. Security researchers raised the alarm on 23 July, and AWS released the clean 1.85.0 the next day. The issue was given CVE-2025-8217.
Your AI tool's supply chain is part of your attack surface. Lock down build tokens and review every commit that reaches a release.
