{"schema_version":"0.8.0","id":"LR-2025-0042","record_version":7,"title":"Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":69.0,"score_breakdown":{"source_authority":16.5,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":9.0,"completeness":6.08,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true},"gate_version":"gate-2026-09-24.4","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-09-26","extraction_run_id":null},"system":{"model_name":"Amazon Q Developer","model_version":null,"developer":"Amazon Web Services","harness":"Amazon Q Developer for Visual Studio Code Extension","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"provider","lifecycle_stage":"production","integration_type":"embedded","intended_use":"AI-powered coding assistance directly into the VS Code integrated development environment (IDE)","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-07-23","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"unknown","summary":"AWS investigated AWS-2025-016 and found the Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in its CodeBuild configuration.","tags":[],"date_detected":null,"near_miss":true,"root_cause":"integration","root_cause_detail":"An inappropriately scoped GitHub token in the CodeBuild configuration let a threat actor commit malicious code into the extension's open-source repository, which was automatically included in a release.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Malicious code was distributed to customers in version 1.84.0 and remains present in existing installations, a live production compromise.","harm_class":["third_party_security"],"affected_description":"existing installations of 1.84.0","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-015/","publisher":"Amazon Web Services","date":"2025-07-23","type":"vendor_research","title":"Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)","archived_url":null},{"url":"https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/","publisher":"The Register","date":"2025-07-24","type":"press","title":"Compromised Amazon Q extension told AI to delete everything - and it shipped","archived_url":null}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.near_miss":"C","event.root_cause":"C","event.adversarial_actor":"C","event.trigger":"C","event.summary":"C","event.incident_class":"C","event.date_disclosed":"A","event.detection_method":"D","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"C","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE)."}],"system.developer":[{"source_index":0,"quote":"AWS is aware of and has addressed an issue in the Amazon Q Developer for VS Code Extension, which is assigned to CVE-2025-8217."}],"system.harness":[{"source_index":0,"quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE)."}],"system.deployment_context":[{"source_index":0,"quote":"This includes removing 1.84.0 from distribution channels so that no further customers can install it."}],"system.lifecycle_stage":[{"source_index":0,"quote":"This includes removing 1.84.0 from distribution channels so that no further customers can install it."}],"system.integration_type":[{"source_index":0,"quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE)."}],"system.intended_use":[{"source_index":0,"quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE)."}],"event.trigger":[{"source_index":0,"quote":"In the course of our investigation of AWS-2025-016, we determined that Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in their CodeBuild configuration."}],"event.summary":[{"source_index":0,"quote":"In the course of our investigation of AWS-2025-016, we determined that Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in their CodeBuild configuration."}],"event.near_miss":[{"source_index":0,"quote":"AWS Security has inspected the code and determined the malicious code was distributed with the extension but was unsuccessful in executing due to a syntax error."}],"event.root_cause":[{"source_index":0,"quote":"In the course of our investigation of AWS-2025-016, we determined that Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in their CodeBuild configuration."}],"event.root_cause_detail":[{"source_index":0,"quote":"In the course of our investigation of AWS-2025-016, we determined that Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in their CodeBuild configuration."}],"event.adversarial_actor":[{"source_index":0,"quote":"With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release."}],"event.incident_class":[{"source_index":0,"quote":"With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release."}],"impact.harm_class":[{"source_index":0,"quote":"With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release."}],"impact.affected_description":[{"source_index":0,"quote":"While the malicious code cannot execute, it is still present in existing installations of 1.84.0."}],"context.industry":[{"source_index":0,"quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE)."}],"impact.severity":[{"source_index":0,"quote":"While the malicious code cannot execute, it is still present in existing installations of 1.84.0."}],"impact.severity_because":[{"source_index":0,"quote":"While the malicious code cannot execute, it is still present in existing installations of 1.84.0."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2025-07-23"}]},"notes_on_gaps":"No source states event.date_occurred, event.detection_method (who first noticed the malicious commit), system.tools_granted, system.permissions_scope, system.autonomy_level, system.guardrails_present, system.safeguard_state, system.production_intended, event.failure_class (no autonomous agent mechanism is stated), event.input_provenance, event.operations_paused, event.remediation, event.precursor_events, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.downstream_exposure_count, context.org_size_band, context.country, context.denominator, context.systemic_exposure, context.shared_model_id, context.upstream_incident_id, context.incident_evidence, context.regulatory, context.coverage. event.trigger is credential_exposure because AWS states the inappropriately scoped GitHub token was the means. event.root_cause is integration because AWS states a scope error in the CodeBuild configuration let the commit happen. impact.severity is major because malicious code reached customers in a production release, though AWS states it could not execute. No dollar figure is stated, so no dollar band applies. Source 1 (The Register) provided no answers, so nothing is cited from it. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-09-29] system.lifecycle_stage: production. system.integration_type: embedded. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.responsible_party: provider. event.detection_method: no source says who first noticed. impact.harm_class: third_party_security. impact.reversibility: reversible. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":"Information","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Amazon Q Developer for VS Code Extension provided AI-powered coding assistance inside the VS Code IDE; AWS built and distributed it, and its CodeBuild configuration held a GitHub token.","quote":"Amazon Q Developer for Visual Studio Code (VS Code) Extension is a development tool that integrates Amazon Q's AI-powered coding assistance directly into the VS Code integrated development environment (IDE).","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A threat actor used the inappropriately scoped GitHub token to commit malicious code into the extension's open-source repository, and that code was automatically included in release 1.84.0.","quote":"With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.","source_index":0,"grade":"C"},{"step":"reached","text":"The malicious code shipped in version 1.84.0 and remains present in existing installations, but a syntax error stopped it from executing, so no services or customer environments were changed.","quote":"AWS Security has inspected the code and determined the malicious code was distributed with the extension but was unsuccessful in executing due to a syntax error.","source_index":0,"grade":"C"},{"step":"caught","text":"AWS Security inspected the code and determined the malicious code could not execute; the bulletin does not say who first noticed the commit.","quote":"AWS Security has inspected the code and determined the malicious code was distributed with the extension but was unsuccessful in executing due to a syntax error.","source_index":0,"grade":"C"},{"step":"done","text":"AWS revoked and replaced the credentials, removed the malicious code, released version 1.85.0, and removed 1.84.0 from distribution channels; customers were told to update and remove 1.84.0.","quote":"After we identified this, we immediately revoked and replaced the credentials, removed the malicious code from the code base, and subsequently released Amazon Q Developer for VS Code Extension version 1.85.0.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-09-29","source_urls":["https://aws.amazon.com/security/security-bulletins/AWS-2025-015/","https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/"]}}