Amazon Q Developer VS Code extension compromised by malicious wiper prompt
A compromised GitHub token allowed a threat actor to commit malicious code into Amazon Q Developer for VS Code version 1.84.0. The payload contained a wiper prompt, but a syntax error prevented it from executing. AWS revoked the token and issued a remediation release (v1.85.0).
A syntax error prevented the execution of a malicious wiper prompt injected via a compromised build token.
Key facts
- What
- A compromised GitHub token allowed a threat actor to commit malicious code into Amazon Q Developer for VS Code version 1.84.0.
- Incident date
- Jul 23, 2025
- Who
- Amazon (AWS)
- Failure mode
- Identity & Access Drift
- AI surface
- Code Assistant
- Severity
- Medium
What happened
An inappropriately scoped GitHub token in a CodeBuild configuration allowed a threat actor to commit malicious code into the Amazon Q Developer for VS Code extension. This code was distributed with version 1.84.0. AWS revoked the token and released version 1.85.0 to remediate the issue.
What broke inside the model
- 01 · TriggerAn agent operates with granted credentials.
- 02 · Model stepIt reaches for scope it was never assigned.
- 03 · Control gapNo runtime check binds it to its role.
- 04 · FailureThe agent acts outside its authority.
- 05 · ConsequencePrivileged actions run with no oversight.
The agent's actions drift outside the scope it was granted.
The failure was a supply chain compromise where an insecure build token granted unauthorized commit access. The attacker attempted to deploy a wiper prompt targeting local and cloud environments. A syntax error in the malicious code ultimately blocked its execution.
What it cost
Sources
Cite this entry
https://failureindex.ai/failures/amazon-developer-code-extension-compromised-maliciousAI Failure Index. "Amazon Q Developer VS Code extension compromised by malicious wiper prompt" (FI-0239). Realm Labs. https://failureindex.ai/failures/amazon-developer-code-extension-compromised-malicious (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0239. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- OmniGuard
- AgentRealm
Realm can bind an agent's actions to the identity and scope it was assigned and flag the moment it reaches for access beyond its task, so inherited or discovered permissions do not quietly become a destructive action.