Supply-chain attack inserts machine-wiping prompt into Amazon Q AI coding assistant
Jul 2025
A rogue contributor injected a malicious prompt into the Amazon Q Developer VS Code extension, instructing the AI coding assistant to wipe local developer machines and AWS resources. AWS quietly yanked the release before widespread damage occurred. The incident illustrates a specific supply-chain risk for AI tools: once a poisoned extension is installed, the AI assistant itself becomes the delivery mechanism - executing destructive instructions with the developer's full trust and permissions.
Incident Details
Perpetrator:Security/AI Product
Severity:Catastrophic
Blast Radius:VS Code update could have erased developer environments and AWS accounts before anyone noticed the tainted build.
Tech Stack
Amazon Q DeveloperAWS Toolkit for VS CodeVS Code MarketplaceAWS CLI
References
Advertisement