Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs

In July 2025 an attacker submitted a pull request to the open-source aws-toolkit-vscode GitHub repository, was granted admin credentials, and injected a prompt-injection payload that shipped in the official Amazon Q for VS Code v1.84.0 release on July 17. The prompt told the AI assistant its goal was to 'clean a system to a near-factory state,' delete filesystem and cloud resources using bash and AWS CLI commands, and 'run continuously until the task is complete.' With nearly one million installs, the compromised extension could have hit developers working on production and critical-infrastructure projects. A syntax error kept the destructive code from actually running; on July 23 researchers flagged suspicious behavior, and by the next day AWS had removed the code, revoked credentials, and released a clean v1.85.0. AWS reported no evidence of customer data loss — but the incident showed how one malicious commit can turn a trusted AI coding agent into a wiper delivered to a million machines.