A wiper prompt shipped inside a coding agent's own update (2025)

The system

The Amazon Q Developer extension for VS Code is an AI coding agent, open-sourced as part of the aws-toolkit-vscode repository, with roughly 950,000 installs. Like most coding agents, it can be instructed in natural language to run shell and cloud-CLI commands on behalf of the developer using it, including against whatever AWS profiles are configured on that machine.

What was observed

On 17 July 2025, version 1.84.0 of the extension shipped publicly to the VS Code Marketplace. It contained an injected prompt instructing the agent to "clear a system to a near-factory state and delete file-system and cloud resources." AWS pulled the compromised build and shipped a fix within roughly two days.

Stop and think

1. The attacker did not target an end user's conversation with the agent. Where in the system did the malicious instruction actually originate, and what does that imply about what "prompt injection" needs to cover?
2. The payload included real AWS CLI commands (ec2 terminate-instances, s3 rm, iam delete-user). What would have had to be true, technically, for those commands to run successfully against a victim's AWS account the moment they installed the update?
3. AWS said the destructive code had a syntax error and never executed against customer resources. If it had been syntactically correct, what single control (if any) would have stood between "the agent received this instruction" and "the agent executed it"?