STUPID-2026-0035
Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs
Why 9/10
A data-wiping prompt shipped to roughly a million installs and failed only because of a syntax error. A near-miss: AWS reports no customer deletion.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Status and what to do
- Affected
- Amazon Q Developer extension for VS Code v1.84.0.
- Fix status
- Fixed · AWS shipped a clean v1.85.0 and revoked the compromised credentials, per the linked report.
- Mitigation
- Make sure the extension is on v1.85.0 or later.
- Last reviewed
- 2026-10-29 · Report a correction to this record
Instruction given
Ship the Amazon Q Developer extension for VS Code to users.
Expected behavior
Vet community pull requests so no attacker can inject agent instructions into an official release.
Actual behavior
An attacker submitted a pull request to the open-source aws-toolkit-vscode repo, was granted admin access, and added a prompt instructing the agent to 'clean a system to a near-factory state,' delete filesystem and cloud resources via bash and AWS CLI, and run continuously until done. It shipped in the official v1.84.0 release.
Damage
The malicious prompt reached an extension with roughly one million installs. A syntax error prevented it from executing, and AWS says no customer environment suffered deletion; AWS revoked credentials and shipped a clean v1.85.0 within a day of disclosure. The near-miss exposed how a single commit can weaponize an AI dev tool at scale.
Full write-up
In July 2025 an attacker submitted a pull request to the open-source aws-toolkit-vscode GitHub repository, was granted admin credentials, and injected a prompt-injection payload that shipped in the official Amazon Q for VS Code v1.84.0 release on July 17. The prompt told the AI assistant its goal was to 'clean a system to a near-factory state,' delete filesystem and cloud resources using bash and AWS CLI commands, and 'run continuously until the task is complete.' With nearly one million installs, the compromised extension could have hit developers working on production and critical-infrastructure projects. A syntax error kept the destructive code from actually running; on July 23 researchers flagged suspicious behavior, and by the next day AWS had removed the code, revoked credentials, and released a clean v1.85.0. AWS reported no evidence of customer data loss — but the incident showed how one malicious commit can turn a trusted AI coding agent into a wiper delivered to a million machines.
Classification
- Agent
- Amazon Q Developer
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Infra
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI04 Agentic Supply Chain Vulnerabilities list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0035: Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0035/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0034By IDSTUPID-2026-0036 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.