A Wiper Prompt Shipped in Amazon Q's VS Code Extension
On this page
A misused build token put 'delete the user's files and cloud resources' into an official, signed AI extension.
| When | July 2025 |
|---|---|
| Target | Amazon Q Developer extension for VS Code |
| Surfaced by | 404 Media; AWS Security Bulletin AWS-2025-015 |
| Technique | Supply-chain compromise via over-privileged CI/CD token |
| CVE | CVE-2025-8217 |
- 1An outsider targets the public aws-toolkit-vscode repo (they claimed via a PR)
- 2An over-privileged CodeBuild GitHub token lets them commit a destructive agent prompt
- 3The signed Amazon Q extension v1.84.0 ships to ~1M users (payload defective, no damage)
What happened
In July 2025, an attacker got a destructive instruction into the official Amazon Q Developer extension for VS Code. Using an over-privileged GitHub token from AWS's CodeBuild configuration, they committed to the public aws-toolkit-vscode repository an agent prompt to 'clean the system to a near-factory state', deleting local files and cloud resources. It shipped in signed release v1.84.0 to roughly a million users. A syntax error stopped the payload executing; AWS pulled 1.84.0, fixed the pipeline, and released 1.85.0 (CVE-2025-8217).
How it happened
The root cause was infrastructure, not the model. An improperly-scoped GitHub token in AWS's CodeBuild let an outsider commit code that was then packaged into the signed extension — so a malicious agent instruction rode a trusted release channel to users. The attacker told 404 Media they got in through a pull request; a later timeline reconstruction by Zenity found no trace of one.
Root cause
Over-privileged CI/CD credentials plus insufficient gating of external contributions to a release pipeline that ships an autonomous coding agent.
What a review would have caught
Least-privilege review of build tokens and diff review of what actually enters a signed release would have caught an injected agent instruction before it shipped.
How to prevent it
- Least-privilege your build and publishing tokens.
- Gate outside contributions to release pipelines with review and isolation.
- Treat agent prompts as executable code deserving supply-chain rigor.
FAQ
How did a wiper prompt get into a signed release?
The real flaw was infrastructure, not the model: an over-privileged GitHub token in AWS's CodeBuild configuration let an outsider commit code to the repository that feeds the build. The injected agent instruction — to delete local files and cloud resources — was then packaged into the official signed extension.
Did it actually wipe anything?
No. The destructive payload contained a syntax error and did not execute, so there's no confirmed damage — but a malicious agent prompt still shipped to ~1M users in a trusted release.
What's the lesson?
Least-privilege your build tokens, gate outside contributions to release pipelines, and treat prompts baked into an agent product as executable code that needs the same supply-chain rigor as binaries.