Amazon Q Extension: A Wiper Hidden in an AI Agent's Instructions
Key takeaways
- →A malicious contributor got a destructive prompt merged into a released version of the Amazon Q Developer VS Code extension.
- →AWS reported the code wasn't functional as intended and pulled the version, but the attack path is real: poisoning the Principal that commands the agent.
- →AgentGuard verifies the integrity of agent instructions and blocks destructive actions that don't fit the developer's task.
- 1
Malicious PR accepted into repo
- 2
Poisoned prompt shipped in release
AgentGuard detects tampered agent instructions and blocks destructive out-of-task actions
- 3
Agent receives wipe instruction
- 4
Agent attempts local & cloud deletion
- 5
Developer environments and resources destroyed
- Affected
- Users of a specific Amazon Q Developer extension version
- When
- July 2025
- Impact
- Attempted destructive instruction; version withdrawn
What happened
In July 2025 AWS published a security bulletin about version 1.84.0 of the Amazon Q Developer extension for VS Code. A contributor had injected code that told the AI agent to clean the system to a near-factory state and delete cloud resources. AWS said the code didn't execute as intended, revoked credentials and released a fixed version.
The real lesson: protect the Commander
The attacker never touched a single endpoint. They changed what the agent was told to do. That's an attack on the AI Principal, specifically the Commander. Any agent shipped with a poisoned system prompt will carry out the attack using its user's permissions.
How AgentGuard would have stopped it
AgentGuard records a baseline of agent instructions and alerts when they change. More importantly, it enforces task context. Deleting home directories and cloud resources doesn't fit any coding-assistance task and gets blocked no matter what the prompt says.
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.