{
 "public_id": "AIR-2025-0062",
 "incident_id": "2025-07-amazon-q-developer-wiper-injection",
 "date_disclosed": "2025-07-23",
 "date_occurred": "2025-07-13",
 "title": "Amazon Q Developer VS Code extension shipped with an attacker-injected system-wiping prompt",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "unvetted_pull_request_merged_into_agent_extension",
 "agent_capability_abused": [
  "shell_execution",
  "aws_cli_access",
  "autonomous_file_deletion",
  "filesystem_write",
  "cloud_api_access",
  "cloud_cli_access",
  "autonomous_shell_execution",
  "trust_all_tools_mode",
  "shell_command_execution",
  "aws_api_access",
  "system_prompt_control",
  "filesystem_tools",
  "bash_execution",
  "cloud_resource_control",
  "agent_instruction_injection",
  "shell_and_cloud_command_execution"
 ],
 "target_product": "Amazon Q Developer Extension for VS Code v1.84",
 "target_vendor": "Amazon Web Services",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "destructive_action",
  "cloud_resource_deletion",
  "data_destruction",
  "supply_chain_compromise",
  "attempted_data_destruction",
  "cloud_resource_destruction"
 ],
 "blast_radius": "one released marketplace version distributed to Amazon Q Developer users before removal",
 "cve": [
  "CVE-2025-8217"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI06",
   "ASI01",
   "ASI04",
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.T0010",
   "AML.CS0047"
  ],
  "labels": [
   "ide_extension",
   "agent_instruction_injection",
   "destructive_payload",
   "unvetted_contributor_pr",
   "supply_chain",
   "prompt_as_payload",
   "release_pipeline_gap",
   "destructive_action",
   "admin_access_granted",
   "malicious_system_prompt",
   "wiper",
   "developer_tooling_supply_chain",
   "overscoped_ci_token",
   "wiper_agent",
   "trust_all_tools",
   "ci_token_scope",
   "system_prompt_injection",
   "destructive_agent",
   "destructive_agent_instruction",
   "weak_repo_review",
   "agent_supply_chain",
   "wiper_prompt",
   "insider_style_commit"
  ]
 },
 "defense_present": "AWS repository code review and release process",
 "defense_bypassed": true,
 "fix_shipped": "version 1.85 released; 1.84 pulled from the Marketplace; credentials revoked",
 "primary_sources": [
  "https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/",
  "https://www.bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands/",
  "https://www.reversinglabs.com/blog/aws-amazonq-ai-incident",
  "https://incidentdatabase.ai/cite/1158",
  "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/",
  "https://www.404media.co/hacker-plants-computer-wiping-commands-in-amazons-ai-coding-agent/",
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml",
  "https://www.koi.ai/blog/amazons-ai-assistant-almost-nuked-a-million-developers-production-environments"
 ],
 "verified_quote": "Once we were made aware of this issue, we immediately revoked and replaced the credentials, removed the unapproved code from the codebase, and subsequently released Amazon Q Developer Extension version 1.85.",
 "confidence": "high",
 "notes": "A GitHub account with no prior access (alias lkmanka58) submitted a PR on 2025-07-13 that was merged; the injected prompt told the agent to act as a system cleaner, delete home-directory files and use AWS profiles to delete cloud resources. AWS says formatting errors made the payload non-functional and reports no customer data loss, so impact_realized is false. The attacker said the goal was to expose 'AI security theater'. Dates differ across sources: The Register says 1.84 shipped 2025-07-19 and 1.85 on 2025-07-21; other coverage says 07-17 and 07-24. Unresolved. | Merged from duplicate id `2025-07-amazon-q-developer-wiper-prompt`. Also reported under the titles: 'A hacker committed system- and cloud-wiping instructions into Amazon Q's VS Code extension repository and Amazon shipped them to a public release'; 'Malicious system-wiping prompt injected into the Amazon Q Developer VS Code extension (v1.84.0)'; 'Malicious commit ships a destructive Amazon Q agent prompt in the Amazon Q VS Code extension v1.84.0'; 'Destructive wiper prompt merged into the Amazon Q VS Code extension and shipped to users'; 'Hacker planted system-wiping instructions in Amazon Q Developer's VS Code extension via a pull request, and Amazon shipped the compromised build'; 'Malicious wiper prompt smuggled into a shipped release of the Amazon Q Developer VS Code extension'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Supply Chain Compromise",
  "Remote Code Execution & Sandbox Escape",
  "Over-permissioned execution & lateral movement"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the shipped agent was instructed to wipe systems and cloud resources",
 "vector_family": "other",
 "vector_detail": "unvetted_pull_request_merged_into_agent_extension",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1158
  ],
  "atlas": [
   "AML.T0010",
   "AML.CS0047"
  ],
  "cve": [
   "CVE-2025-8217"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "supply_chain_vulnerabilities"
 ],
 "eai_reason": "impact rule: unsafe_actuation",
 "asi_curated": [
  "ASI05",
  "ASI06",
  "ASI01",
  "ASI04",
  "ASI03"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated",
 "asi_reason": "curated: ASI05,ASI06,ASI01,ASI04,ASI03",
 "submitted_by": "EAI Internal"
}