Jul 28, 2025Single source
Amazon Q Developer VS Code extension shipped with an injected prompt to wipe systems
Rogue: Caused harmAI loose in the worldInjectionDERIVED
Approved by person, Oct 11, 2026. How entries are approved
A hacker added a prompt instructing the agent to clean a system to near-factory state and delete file-system and cloud resources to the Amazon Q GitHub repository on July 13, 2025, and it shipped in version 1.84.0 on July 17. AWS acknowledged the issue on July 23, said the prompt was malformed and no customer resources were affected, and released 1.85.0.
What this means for youAI coding tools are a supply chain; pin versions and review extension updates like any other software you install.
Sources
- TechRepublichttps://www.techrepublic.com/article/news-amazon-q-data-wiping-prompt-security-hack/
rogue:R4
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2138. It has not been edited since it was approved; the hash above would not match if it had. How to verify