Malicious wiping prompt shipped in Amazon Q Developer extension for VS Code

Version 1.84.0 of the Amazon Q Developer extension for Visual Studio Code, an AI coding assistant, was released with malicious code that an attacker had committed to its open-source repository. BleepingComputer reported that the tainted build reached the marketplace on 17 July 2025; AWS said the code failed to run because of a syntax error.

What happened

AWS said its investigation found that the extension's build configuration in CodeBuild held a GitHub token with more access than it needed. With that token, the attacker committed code to the repository, and the automated pipeline folded it into a release.

The added commit was a prompt aimed at the assistant itself. BleepingComputer reported that it told the agent to return a system to a near-factory state and delete file-system and cloud resources.

Impact

According to AWS, the syntax error stopped the code from changing any services or customer environments. The code still sits inside existing 1.84.0 installations even though it cannot execute. How many users installed that version before it was withdrawn has not been published.

Response

AWS revoked and replaced the credentials, stripped the code out and released version 1.85.0. It removed 1.84.0 from distribution and told customers to delete every installation of it, including forks and derivative copies.

Lessons for security leaders

• For AI coding tools, a prompt is code. Review changes to system prompts and agent instructions with the same care as executable changes.
• Scope CI tokens to the narrowest permission that works, and require human approval before anything committed by an outside contributor can reach a release.
• Keep an inventory of IDE extensions in use so a bad version can be found and removed quickly across developer machines.
• Limit what coding agents may do on a workstation and in cloud accounts, so a hostile instruction has little to act on.