PIR-2026-0030 - Amazon Q Developer VS Code extension ships with an injected system-wipe prompt (v1.84.0)

id: PIR-2026-0030
title: Outside contributor plants a natural-language wipe-your-system prompt in the aws-toolkit-vscode repo; it auto-builds into official release v1.84.0 (~1M installs) and fails only on a syntax error
date_occurred: 2025-07-13 (malicious PR/commit) -> 2025-07-17 (poisoned v1.84.0 published)
date_detected: ~2025-07-23 (researchers/reporting flag the malicious commit; attacker also contacted press)
date_disclosed: 2025-07-23/24 (404 Media report; AWS bulletin AWS-2025-015 and GitHub advisory GHSA-7g7f-ff96-5gcw; clean v1.85.0 shipped)
status: corrected

agent_description: Amazon Q Developer extension for VS Code - agentic coding assistant with shell and AWS CLI execution on the developer's host; distributed by AWS through the VS Code marketplace at ~1M installs (marketplace count ~950K+).
operator_type: enterprise (AWS-built and -distributed; end operators are individual developers)
autonomy_level: human-on-the-loop typical (agent executes commands with configurable confirmation); the payload targeted whatever autonomy each install allowed
model_stack: Amazon Q Developer hosted models (payload was model-agnostic natural language)
harness: VS Code extension + open-source aws-toolkit-vscode repo + AWS CodeBuild release pipeline (the compromised link)

authority_scope: code execution (shell on host), credentials (local AWS credentials), data access (home directory), cloud resources (EC2/S3/IAM via AWS CLI)
funds_at_risk_usd: unknown/unbounded (fleet-wide destructive potential across ~1M installs; no meaningful cap existed)
blast_radius: customers/third parties (every installed developer machine + their AWS accounts)

root_cause: supply-chain-compromise (primary; v0.1 taxonomy - the compromised release pipeline is the failure); contributing prompt-injection (the payload's form: a natural-language instruction to the agent) and operator-error (overscoped GitHub token in the CodeBuild configuration granting a stranger admin-equivalent access)
failure_locus: dependency (marketplace-distributed tool poisoned upstream of every operator)
exploitation_status: in-wild-payload-failed (malicious artifact reached ~1M real installs for ~5-6 days; payload did not execute)
mechanism: An outsider submitted a PR to aws-toolkit-vscode on ~July 13 and, via an inappropriately scoped GitHub token in the CodeBuild configuration, obtained admin-level commit access ("admin credentials on a silver platter," per the attacker to 404 Media). They committed a prompt instructing the agent to "clean a system to a near-factory state" - wipe the home directory and delete EC2/S3/IAM resources via AWS CLI. The commit auto-built into official v1.84.0, published July 17. A syntax/formatting error prevented the injected prompt from executing. AWS revoked credentials, removed the code, and shipped v1.85.0.
adversary_present: yes (attacker claims the payload was deliberately defanged as a demonstration - unverifiable)

severity: near-miss (full distribution of a destructive payload; zero realized execution)
direct_loss_usd: 0 (per AWS: no changes to any services or customer environments)
indirect_loss_usd: unknown (AWS incident response; customer update burden)
downtime: none (v1.84.0 pulled; users required to update to 1.85.0)
data_exposure: none reported

detected_by: third-party / attacker-disclosure (security researchers flagged the commit; the attacker simultaneously self-disclosed to 404 Media) - not by AWS pipeline controls
time_to_detect: ~6-10 days from malicious commit; ~5-6 days of poisoned release live
time_to_recover: ~1-2 days from detection (credentials revoked, build pulled, v1.85.0 released)
remediation: credential revocation, malicious code removal, forced version deprecation, security bulletin
structural_fix: release-pipeline credential scoping tightened (per AWS); the deeper fact stands - a marketplace agent's prompt channel is part of its supply chain
controls_that_worked: none - the outcome was bounded by the attacker's defective (or deliberately defanged) payload, not by any AWS or user control. Actuarially this is luck, not defense; recorded per v0.1 exploitation_status exactly to avoid conflating it with defended near-misses.

telemetry_grade: operator-logs (AWS's account), corroborated by public git history and the marketplace release record
sources: https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ (first-party); https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw (first-party); https://www.scworld.com/news/amazon-q-extension-for-vs-code-reportedly-injected-with-wiper-prompt; https://awsinsider.net/articles/2025/07/25/formatting-flaw-foils-attempted-prompt-injection-on-amazon-q.aspx; https://www.reversinglabs.com/blog/aws-amazonq-ai-incident. Independence: good - first-party bulletins plus unaffiliated security press; attacker's account via 404 Media (referenced in the above).
confidence: high on timeline and mechanism; medium on "zero damage" (rests on AWS's attestation plus the attacker's claim - named weakest link)

Root cause reclassified under v0.1. Intake (drafted pre-amendment) filed this as primary prompt-injection. Under the amended taxonomy the primary is supply-chain-compromise with failure_locus dependency - the v0.1 amendment names this exact cluster. Prompt-injection kept as contributing (payload form).
Bulletin conflict resolved. Intake flagged AWS-2025-015 vs AWS-2025-019. Verified: AWS-2025-015 (July 2025) is this incident; AWS-2025-019 (Oct 2025) covers unrelated Embrace The Red-reported prompt-injection/RCE issues in Q Developer and Kiro. AWS-2025-019 removed from sources.
Exposure window corrected. Intake said the poisoned release was live "~2 days"; the verified timeline (v1.84.0 published 2025-07-17, detection ~2025-07-23) gives ~5-6 days of distribution.
Intake's bleepingcomputer/404media/techradar/devops.com URLs not re-verified directly (404 Media's reporting reached me via secondary sources); replaced with verified equivalents (SC Media, AWSInsider, ReversingLabs).