Malicious Pull Request Nearly Led to AI Coding Assistant Wiping User Systems

Malicious Code Submitted to AWS Toolkit

On July 13, 2025, a GitHub user submitted a pull request to Amazon's public aws-toolkit-vscode repository. This request, which appeared innocuous and reused a previous legitimate commit title, was subsequently merged and shipped to almost a million developers using the Visual Studio Code marketplace.

Near-Miss System Wipe

The merged update included code that downloaded an external file during the build process and injected a new prompt into the extension's packaging script. This prompt instructed the Q Developer AI agent to wipe the system to a near-factory state and delete file-system and cloud resources. The script was configured to pass this prompt directly to the command-line interface without requiring further approvals from the AI agent.

Attack Prevented by Formatting Error

The malicious code did not execute successfully in any customer environment due to a formatting error in the prompt. Amazon's security team confirmed this failure. The individual responsible for the attack claimed it was a stunt to highlight lax security practices and concerns about AI replacing human workers.

Additional Vulnerability Discovered

Separately, independent researcher Johann Rehberger identified another vulnerability in Q Developer. He found that the AI assistant could execute bash commands, such as 'find', without requiring explicit permission, which could potentially lead to file leaks or remote code execution. This flaw was reported on July 7 and patched by July 18, though no CVE was issued as it required a system compromise to be exploited. A security bulletin was later published.