Amazon Q VS Code Extension: Wiper Prompt via Supply-Chain Compromise
An attacker gained write access to the open-source Amazon Q VS Code extension repo and slipped a prompt into an official release instructing the AI agent to wipe the local filesystem and cloud resources. It shipped to users before AWS pulled it — the payload failed only due to a syntax error.
What happened
In July 2025 an attacker submitted a pull request to the open-source aws-toolkit-vscode repository and — thanks to an over-scoped GitHub token in the project’s CodeBuild configuration — obtained admin access. They committed a prompt into the extension that was automatically included in the official release of Amazon Q Developer for VS Code v1.84.0.
The injected instruction told the AI agent its goal was to “clean a system to a near-factory state and delete file-system and cloud resources” — a wiper aimed at developers’ machines and their connected AWS environments. The malicious build reached users before AWS caught it; per AWS, the code failed to execute due to a syntax error, so no customer environments were altered. AWS revoked the credentials, removed the code, and shipped v1.85.0.
Why it maps to ATLAS
- AML.T0010.005 — AI Supply Chain Compromise: AI Agent Tool: the coding agent’s distribution channel (the extension) was compromised at the source.
- AML.T0011.002 — User Execution: Poisoned AI Agent Tool: users installed and ran the poisoned extension.
- AML.T0051 — LLM Prompt Injection: the payload was an instruction crafted to hijack the agent’s behavior.
- AML.T0101 — Data Destruction via AI Agent Tool Invocation: the intended impact was destroying local and cloud resources through the agent’s tools.
Detection notes
This is a classic supply-chain compromise wearing an AI hat: the malicious content is an instruction to an agent rather than a binary. Controls sit at the pipeline (least-privilege CI tokens, signed/reviewed releases) and at execution (sandboxed tool actions, confirmation gates on destructive operations). A coding agent reaching for mass deletion or cloud teardown should never be a silent, auto-approved action.
Detection
Log sources
- Extension release provenance / CI commit audit
- Agent action logs (file + cloud resource operations)
- Endpoint telemetry on the developer host
Signals
- Destructive instructions embedded in an agent's system/tooling content
- Coding agent attempting mass file deletion or cloud-resource teardown
- Unexpected commits to a released extension from over-scoped CI tokens
Mitigations
- Least-privilege CI tokens; no admin-scoped credentials in build config
- Sign and verify extension releases; review diffs before publish
- Sandbox agent tool actions; require confirmation for destructive operations