A Wiper Prompt Shipped in Amazon Q's VS Code Extension
On this page
A malicious pull request put 'delete the user's files and cloud resources' into an official, signed AI extension.
| When | July 2025 |
|---|---|
| Target | Amazon Q Developer extension for VS Code |
| Surfaced by | 404 Media; AWS Security Bulletin AWS-2025-015 |
| Technique | Supply-chain compromise via over-privileged CI/CD token |
| CVE | CVE-2025-8217 |
- 1An outside contributor opens a PR to the public aws-toolkit-vscode repo
- 2An over-privileged build token lets it inject a destructive agent prompt
- 3The signed Amazon Q extension v1.84.0 ships to ~1M users (payload defective, no damage)
What happened
In July 2025, an attacker got a destructive instruction into the official Amazon Q Developer extension for VS Code. Via a pull request to the public aws-toolkit-vscode repository — and an over-privileged token in AWS's build pipeline — they injected an agent prompt to 'clean the system to a near-factory state', deleting local files and cloud resources. It shipped in signed release v1.84.0 to roughly a million users. A syntax error stopped the payload executing; AWS pulled 1.84.0, fixed the pipeline, and released 1.85.0 (CVE-2025-8217).
How it happened
The root cause was infrastructure, not the model. An improperly-scoped GitHub token in AWS's CodeBuild allowed an outside contribution to reach the build and be packaged into the signed extension — so a malicious agent instruction rode a trusted release channel to users.
Root cause
Over-privileged CI/CD credentials plus insufficient gating of external contributions to a release pipeline that ships an autonomous coding agent.
What a review would have caught
Least-privilege review of build tokens and diff review of what actually enters a signed release would have caught an injected agent instruction before it shipped.
How to prevent it
- Least-privilege your build and publishing tokens.
- Gate outside contributions to release pipelines with review and isolation.
- Treat agent prompts as executable code deserving supply-chain rigor.
FAQ
How did a wiper prompt get into a signed release?
The real flaw was infrastructure, not the model: an over-privileged GitHub token in AWS's CodeBuild pipeline let an outside pull request reach the build. The injected agent instruction — to delete local files and cloud resources — was then packaged into the official signed extension.
Did it actually wipe anything?
No. The destructive payload contained a syntax error and did not execute, so there's no confirmed damage — but a malicious agent prompt still shipped to ~1M users in a trusted release.
What's the lesson?
Least-privilege your build tokens, gate outside contributions to release pipelines, and treat prompts baked into an agent product as executable code that needs the same supply-chain rigor as binaries.