Rank #15 of 24·Security·23 Jul 2025·Amazon Q Developer extension
Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension
Chaos index8.0 / 10
0246810
“Saved by a typo. Somewhere, a linter is weeping with pride.”
What happened
Using an inappropriately scoped GitHub token, an attacker committed a prompt telling the agent to reset systems to near-factory state and delete cloud resources. It shipped in version 1.84.0. AWS says a syntax error stopped it running and released a clean 1.85.0.
How to not be next
Lock down CI tokens and review every commit that ships in an agent's release.
Source: AWS security bulletin ↗