Cases › security breach › LR-2025-0042
Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources
Whose AI: Amazon · Amazon Q Developersecurity breach
Severity major: Malicious code was distributed to customers in version 1.84.0 and remains present in existing installations, a live production compromise.
Earliest source we hold 2025-07-23
AWS investigated AWS-2025-016 and found the Amazon Q Developer for VS Code Extension had an inappropriately scoped GitHub token in its CodeBuild configuration.
Risk grouping: Supply chain attack
| Who caused it | A person or organisation “With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.” source |
|---|---|
| Intended or not | Intended “With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.” source |
| Before or after release | Before release “With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.” source |
| The AI's part | Attacked “With that access token, the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.” source |
The story
1 · What it was doingAmazon Q Developer for VS Code Extension provided AI-powered coding assistance inside the VS Code IDE; AWS built and distributed it, and its CodeBuild configuration held a GitHub token.
2 · What went wrongA threat actor used the inappropriately scoped GitHub token to commit malicious code into the extension's open-source repository, and that code was automatically included in release 1.84.0.
3 · What it reached or didThe malicious code shipped in version 1.84.0 and remains present in existing installations, but a syntax error stopped it from executing, so no services or customer environments were changed.
4 · How it was caughtAWS Security inspected the code and determined the malicious code could not execute.
5 · What was doneAWS revoked and replaced the credentials, removed the malicious code, released version 1.85.0, and removed 1.84.0 from distribution channels; customers were told to update and remove 1.84.0.
What the sources state
- Cause a permission, scope or wiring error
- What set it off exposed credentials
Others like this
Show every field, with its source and grade
The AI system
Model
Amazon Q Developer
C one secondary source states it
Developer
Amazon Web Services
C one secondary source states it
Software around the model
Amazon Q Developer for Visual Studio Code Extension
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
How it was connected
embedded
D inferred by us from the described behaviour, reason shown
What it was for
AI-powered coding assistance directly into the VS Code integrated development environment (IDE)
C one secondary source states it
What happened
Earliest source we hold
2025-07-23
A the date the source itself carries
What set it off
exposed credentials
C one secondary source states it
Near miss
yes, no harm happened
C one secondary source states it
Cause
a permission, scope or wiring error
C one secondary source states it
Cause in detail
An inappropriately scoped GitHub token in the CodeBuild configuration let a threat actor commit malicious code into the extension's open-source repository, which was automatically included in a release.
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security
D inferred by us from the described behaviour, reason shown
Who was affected
existing installations of 1.84.0
C one secondary source states it
Why this severity
Malicious code was distributed to customers in version 1.84.0 and remains present in existing installations, a live production compromise.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
LR-2025-0042 · version 7 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON