This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A hacker compromised the Amazon Q VS Code extension by injecting malicious code into its GitHub repository, which was subsequently included in a public release. The injected code contained instructions to wipe local files and cloud resources, but it failed to execute due to a syntax error. Amazon has since mitigated the issue and released an updated version of the extension.
A reported compromise of Amazon's AI coding assistant "Q" allegedly involved the insertion of commands that, if executed, could have wiped local files and potentially affected cloud resources. The altered code was reportedly incorporated into a public release before being detected and removed.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
Critics highlighted a lack of regulatory oversight and basic guardrails in Amazon's verification process before releasing the AI product.
The incident involved a supply chain attack where a threat actor exploited a security vulnerability in the AI tool's development toolchain to inject malicious code.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by a human threat actor intentionally injecting malicious code into the repository of a deployed AI extension.
A supply chain attack compromised the Amazon Q VS Code extension, attempting to use prompt-engineered instructions to force the AI agent to delete local and cloud files. Although the payload failed to execute due to a syntax error, the incident highlights emerging vulnerabilities in AI development toolchains and the potential for automated destructive actions via compromised AI assistants.
The reports describe Amazon Q as an 'AI coding assistant' and a 'development tool' designed to help developers write, test, and deploy code. It operates within the VS Code IDE to provide suggestions and coding assistance, fitting the Assistant profile.
Limited Risk (Level 3): The system is an interactive generative AI coding assistant ('Amazon Q') that interacts with users to generate code, which falls under the transparency requirements of Limited Risk systems.
Amazon Q is explicitly described as an AI-powered coding assistant designed to help developers write, test, and deploy code.
The reports from AWS, ZDNet, and Public Citizen provide consistent details regarding the nature of the supply chain attack, the specific mechanism of the exploit (GitHub token compromise), the intended payload (system wiping commands), and the outcome (failure to execute due to a syntax error). There is high agreement on the facts of the incident.
None. The event is clearly a supply chain security compromise of an AI developer tool.
Technology
Insecure GitHub Token Scope
Inappropriately scoped token in CodeBuild allowed repo write access.
AI Vulnerable to Prompt Injection
The AI agent accepted system-wiping instructions via prompt injection.
Data Inputs
Malicious Code Injection
Malicious pull request containing system-wiping commands was submitted.
Human Factors
Lax Developer Oversight
Reviewers approved a destructive pull request without proper scrutiny.
Process and Methods
Weak Code Verification Process
Amazon's verification failed to detect the malicious code before release.
Automated Release of Unchecked Code
Code Build automatically packaged compromised code into public release.
Missing AI Safety Guardrails
The AI assistant lacked guardrails against executing destructive bash tools.
Management
Rushing AI Products to Market
Prioritizing rapid release and profit over robust safety verification.
Deficient Incident Transparency
Quietly removing the extension without a CVE damaged developer trust.
Regulatory Environment
Lack of Enforceable AI Rules
Absence of mandatory pre-market safety reviews and compliance audits.
Undefined AI Liability Standards
No legal liability framework to enforce rigorous safety checks on AI.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
