# PIR-2026-0030 - Amazon Q Developer VS Code extension ships with an injected system-wipe prompt (v1.84.0)

- `id`: PIR-2026-0030
- `title`: Outside contributor plants a natural-language wipe-your-system prompt in the aws-toolkit-vscode repo; it auto-builds into official release v1.84.0 (~1M installs) and fails only on a syntax error
- `date_occurred`: 2025-07-13 (malicious PR/commit) -> 2025-07-17 (poisoned v1.84.0 published)
- `date_detected`: ~2025-07-23 (researchers/reporting flag the malicious commit; attacker also contacted press)
- `date_disclosed`: 2025-07-23/24 (404 Media report; AWS bulletin AWS-2025-015 and GitHub advisory GHSA-7g7f-ff96-5gcw; clean v1.85.0 shipped)
- `status`: corrected

### The agent
- `agent_description`: Amazon Q Developer extension for VS Code - agentic coding assistant with shell and AWS CLI execution on the developer's host; distributed by AWS through the VS Code marketplace at ~1M installs (marketplace count ~950K+).
- `operator_type`: enterprise (AWS-built and -distributed; end operators are individual developers)
- `autonomy_level`: human-on-the-loop typical (agent executes commands with configurable confirmation); the payload targeted whatever autonomy each install allowed
- `model_stack`: Amazon Q Developer hosted models (payload was model-agnostic natural language)
- `harness`: VS Code extension + open-source aws-toolkit-vscode repo + AWS CodeBuild release pipeline (the compromised link)

### Authority
- `authority_scope`: code execution (shell on host), credentials (local AWS credentials), data access (home directory), cloud resources (EC2/S3/IAM via AWS CLI)
- `funds_at_risk_usd`: unknown/unbounded (fleet-wide destructive potential across ~1M installs; no meaningful cap existed)
- `blast_radius`: customers/third parties (every installed developer machine + their AWS accounts)

### The failure
- `root_cause`: supply-chain-compromise (primary; v0.1 taxonomy - the compromised release pipeline is the failure); contributing `prompt-injection` (the payload's form: a natural-language instruction to the agent) and `operator-error` (overscoped GitHub token in the CodeBuild configuration granting a stranger admin-equivalent access)
- `failure_locus`: dependency (marketplace-distributed tool poisoned upstream of every operator)
- `exploitation_status`: in-wild-payload-failed (malicious artifact reached ~1M real installs for ~5-6 days; payload did not execute)
- `mechanism`: An outsider submitted a PR to aws-toolkit-vscode on ~July 13 and, via an inappropriately scoped GitHub token in the CodeBuild configuration, obtained admin-level commit access ("admin credentials on a silver platter," per the attacker to 404 Media). They committed a prompt instructing the agent to "clean a system to a near-factory state" - wipe the home directory and delete EC2/S3/IAM resources via AWS CLI. The commit auto-built into official v1.84.0, published July 17. A syntax/formatting error prevented the injected prompt from executing. AWS revoked credentials, removed the code, and shipped v1.85.0.
- `adversary_present`: yes (attacker claims the payload was deliberately defanged as a demonstration - unverifiable)

### Impact
- `severity`: near-miss (full distribution of a destructive payload; zero realized execution)
- `direct_loss_usd`: 0 (per AWS: no changes to any services or customer environments)
- `indirect_loss_usd`: unknown (AWS incident response; customer update burden)
- `downtime`: none (v1.84.0 pulled; users required to update to 1.85.0)
- `data_exposure`: none reported

### Detection and recovery
- `detected_by`: third-party / attacker-disclosure (security researchers flagged the commit; the attacker simultaneously self-disclosed to 404 Media) - not by AWS pipeline controls
- `time_to_detect`: ~6-10 days from malicious commit; ~5-6 days of poisoned release live
- `time_to_recover`: ~1-2 days from detection (credentials revoked, build pulled, v1.85.0 released)
- `remediation`: credential revocation, malicious code removal, forced version deprecation, security bulletin
- `structural_fix`: release-pipeline credential scoping tightened (per AWS); the deeper fact stands - a marketplace agent's prompt channel is part of its supply chain
- `controls_that_worked`: none - the outcome was bounded by the attacker's defective (or deliberately defanged) payload, not by any AWS or user control. Actuarially this is luck, not defense; recorded per v0.1 exploitation_status exactly to avoid conflating it with defended near-misses.

### Evidence
- `telemetry_grade`: operator-logs (AWS's account), corroborated by public git history and the marketplace release record
- `sources`:
  - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ (first-party)
  - https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw (first-party)
  - https://www.scworld.com/news/amazon-q-extension-for-vs-code-reportedly-injected-with-wiper-prompt
  - https://awsinsider.net/articles/2025/07/25/formatting-flaw-foils-attempted-prompt-injection-on-amazon-q.aspx
  - https://www.reversinglabs.com/blog/aws-amazonq-ai-incident
  - `independence`: good - first-party bulletins plus unaffiliated security press; attacker's account via 404 Media (referenced in the above).
- `aiid_incident_id`: 1158 (https://incidentdatabase.ai/cite/1158/) - cross-reference; primaries verified independently
- `confidence`: high on timeline and mechanism; medium on "zero damage" (rests on AWS's attestation plus the attacker's claim - named weakest link)

### Verification notes
1. **Root cause reclassified under v0.1.** Intake (drafted pre-amendment) filed this as primary prompt-injection. Under the amended taxonomy the primary is `supply-chain-compromise` with failure_locus `dependency` - the v0.1 amendment names this exact cluster. Prompt-injection kept as contributing (payload form).
2. **Bulletin conflict resolved.** Intake flagged AWS-2025-015 vs AWS-2025-019. Verified: AWS-2025-015 (July 2025) is this incident; AWS-2025-019 (Oct 2025) covers unrelated Embrace The Red-reported prompt-injection/RCE issues in Q Developer and Kiro. AWS-2025-019 removed from sources.
3. **Exposure window corrected.** Intake said the poisoned release was live "~2 days"; the verified timeline (v1.84.0 published 2025-07-17, detection ~2025-07-23) gives ~5-6 days of distribution.
4. Intake's bleepingcomputer/404media/techradar/devops.com URLs not re-verified directly (404 Media's reporting reached me via secondary sources); replaced with verified equivalents (SC Media, AWSInsider, ReversingLabs).

### Corrections

- 2026-08-19: Added `aiid_incident_id` cross-reference (AIID 1158), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.