2025-07-17 · 2025-Q3
Amazon Q VS Code Extension Compromise
Layer tags: not yet tagged.
Target
Amazon Q Developer Extension (950K+ installs)
Impact
Compromised v1.84.0 live for two days; destructive AI prompt instructed deletion of home directory and AWS resources; failed due to syntax error
Root Cause
Over-scoped GitHub token in CI/CD pipeline