Wiper instruction shipped inside Amazon's AI coding extension

A malicious change to Amazon Q Developer's open-source VS Code extension shipped to users in July 2025 after an outside contributor's pull request was merged into the project. The change added a prompt instructing the AI agent to clean a system to a "near-factory state" and delete cloud resources. It was included in version 1.84.0 of the extension.

404 Media first reported the incident after the person responsible contacted the outlet. The individual said the goal was to expose what they described as weak security practices in the project, and claimed they had obtained access through a token with more privileges than expected.

AWS published a security bulletin confirming that the unapproved code had been included in the release. The company said the malicious prompt was malformed and would not have executed as written, removed version 1.84.0 from the marketplace, and published 1.85.0 with the change reverted. AWS said it had revoked the credentials involved and found no evidence that customer resources had been affected.

The case was notable because the payload was not conventional malware but a natural-language instruction aimed at the agent itself. Whether it worked depended on how the extension assembled its prompts rather than on any code vulnerability.

Security researchers pointed to two lessons: repositories that produce agent tooling need the same supply-chain controls as any other software, and prompt text embedded in a build is executable content that should be reviewed as such.