Amazon Q extension for VS Code ships with an injected destructive prompt
An attacker used an over-scoped token to commit a prompt that told the Amazon Q agent to delete files and cloud resources. It shipped in a release but did not run, according to AWS.
- Occurred
- Disclosed
- Published
- Organization
- Amazon Web Services
- System
- Amazon Q Developer extension for Visual Studio Code, version 1.84.0
- Impact
- Malicious code shipped in a public release; AWS states it failed to execute and no customer environment was changed
- Root cause
- Inappropriately scoped GitHub token in the build configuration
Timeline
- 2025-07-19. Version 1.84 is released with the malicious code, according to The Register.
- Two days later. Version 1.85 reverts the change.
- 2025-07-23. AWS publishes its security bulletin and CVE-2025-8217.
Trigger or entry point
A commit to the extension’s open-source repository by an outside party.
Failure mechanism
AWS states that a GitHub token in its CodeBuild configuration was “inappropriately scoped”. A threat actor used it to commit code that was then included in a release automatically. According to The Register, the code passed a prompt to the Amazon Q command-line agent with flags that disable confirmation. The prompt told the agent to delete files in the user’s home directory and to find and delete cloud resources through the AWS CLI. The flags named by The Register tell the command-line agent to trust all tools and to run without interaction.
Impact
AWS states that the code was “unsuccessful in executing due to a syntax error” and could not change services or customer environments. The severity is potential. AWS notes that the code is still present in existing installations of version 1.84.0, which is why it asks customers to remove that version.
Response
AWS removed version 1.84.0 from distribution and released version 1.85.0. The bulletin was updated on 2025-07-25.
Mitigations
AWS advises removing any installation of version 1.84.0 and updating.
Sources
Corrections
No corrections have been made to this entry.
Report a correction