AIR-2025-0062 · Amazon Q Developer VS Code extension shipped with an attacker-injected system-wiping prompt

Amazon Q Developer VS Code extension shipped with an attacker-injected system-wiping prompt

AIR-2025-0062 AIR record · 2025-07-amazon-q-developer-wiper-injection

From the supporting source

Once we were made aware of this issue, we immediately revoked and replaced the credentials, removed the unapproved code from the codebase, and subsequently released Amazon Q Developer Extension version 1.85.theregister.com

The record

Disclosed

2025-07-23

Occurred

2025-07-13

Vendor

Amazon Web Services

Product

Amazon Q Developer Extension for VS Code v1.84

Risk domain

Agent behaviour › Unsafe actuation

Also touches

Supply chain vulnerabilities

System type

Generative model

Who acted

Agent acted (contested) — the shipped agent was instructed to wipe systems and cloud resources

Attack surface

Coding agent

Autonomy level

Semi-autonomous

Initial vector

Unvetted pull request merged into agent extension

Impact type

Destructive action, Cloud resource deletion, Data destruction, Supply chain compromise, Attempted data destruction, Cloud resource destruction

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI01 – Agent Goal Hijack
MITRE ATLAS: AML.T0048 – External Harms
NIST AI RMF: MEASURE 2.6; MANAGE 1.3
EU AI Act: Annex III §1(c)
ISO/IEC: TR 24028; 24029-1; 23894
AIUC-1: C. Safety
Scope: agent misuse
Mitigation: Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

one released marketplace version distributed to Amazon Q Developer users before removal

Capability abused

shell_executionaws_cli_accessautonomous_file_deletionfilesystem_writecloud_api_accesscloud_cli_accessautonomous_shell_executiontrust_all_tools_modeshell_command_executionaws_api_accesssystem_prompt_controlfilesystem_toolsbash_executioncloud_resource_controlagent_instruction_injectionshell_and_cloud_command_execution

Defense & remediation

Recorded defense

AWS repository code review and release process

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

version 1.85 released; 1.84 pulled from the Marketplace; credentials revoked

Taxonomy & references

OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI06 Memory & Context Poisoning OWASP ASI01 Agent Goal Hijack OWASP ASI04 Agentic Supply Chain Vulnerabilities OWASP ASI03 Identity and Privilege Abuse ATLAS AML.T0010 ATLAS AML.CS0047 CVE-2025-8217ide_extensionagent_instruction_injectiondestructive_payloadunvetted_contributor_prsupply_chainprompt_as_payloadrelease_pipeline_gapdestructive_actionadmin_access_grantedmalicious_system_promptwiperdeveloper_tooling_supply_chainoverscoped_ci_tokenwiper_agenttrust_all_toolsci_token_scopesystem_prompt_injectiondestructive_agentdestructive_agent_instructionweak_repo_reviewagent_supply_chainwiper_promptinsider_style_commit

Curator notes

A GitHub account with no prior access (alias lkmanka58) submitted a PR on 2025-07-13 that was merged; the injected prompt told the agent to act as a system cleaner, delete home-directory files and use AWS profiles to delete cloud resources. AWS says formatting errors made the payload non-functional and reports no customer data loss, so impact_realized is false. The attacker said the goal was to expose 'AI security theater'. Dates differ across sources: The Register says 1.84 shipped 2025-07-19 and 1.85 on 2025-07-21; other coverage says 07-17 and 07-24. Unresolved. | Merged from duplicate id `2025-07-amazon-q-developer-wiper-prompt`. Also reported under the titles: 'A hacker committed system- and cloud-wiping instructions into Amazon Q's VS Code extension repository and Amazon shipped them to a public release'; 'Malicious system-wiping prompt injected into the Amazon Q Developer VS Code extension (v1.84.0)'; 'Malicious commit ships a destructive Amazon Q agent prompt in the Amazon Q VS Code extension v1.84.0'; 'Destructive wiper prompt merged into the Amazon Q VS Code extension and shipped to users'; 'Hacker planted system-wiping instructions in Amazon Q Developer's VS Code extension via a pull request, and Amazon shipped the compromised build'; 'Malicious wiper prompt smuggled into a shipped release of the Amazon Q Developer VS Code extension'.

Cite as

Enkrypt AI. "Amazon Q Developer VS Code extension shipped with an attacker-injected system-wiping prompt". AIR, AIR-2025-0062. https://agentincident.vercel.app/i/AIR-2025-0062/ (accessed 2026-10-19).