Disclosed vulnerability
Amazon Q Developer: RCE because find was allowlisted as read-only despite -exec
AIR-2025-0105 AIR record · 2025-08-amazon-q-developer-rce
From the supporting source
This means we were able to run arbitrary remote commands dynamically too and by just changing the payload we can download malware to the developer's machine and have it join a botnet.embracethered.com
The record
Disclosed
2025-08-19
Vendor
Amazon Web Services
Product
Amazon Q Developer VS Code extension
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Amazon Q executed find -exec, giving RCE and C2
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection source code
Impact type
Remote code execution, C2 control, Code execution, Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Amazon Q Developer users before v1.85
Capability abused
Defense & remediation
Recorded defense
executeBash requires developer consent for mutating commands; find was misclassified as readonly
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
patched in v1.85 on 2025-07-17, 13 days after the report; AWS declined a CVE
Taxonomy & references
Curator notes
Month of AI Bugs. | Merged from duplicate id `2025-08-amazon-q-find-exec-rce`. Also reported as: 'Amazon Q Developer: remote code execution and DNS secret exfiltration via prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Amazon Q Developer: RCE because find was allowlisted as read-only despite -exec". AIR, AIR-2025-0105. https://agentincident.vercel.app/i/AIR-2025-0105/ (accessed 2026-10-19).