--- title: One pull to wipe them all | daily.dev description: A malicious pull request submitted to Amazon's public aws-toolkit-vscode repository in July 2025 injected a prompt instructing the Q Developer AI coding agent... canonical: https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: One pull to wipe them all | daily.dev og:description: A malicious pull request submitted to Amazon's public aws-toolkit-vscode repository in July 2025 injected a prompt instructing the Q Developer AI coding agent... og:url: https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a og:image: https://api.daily.dev/og/posts/Sr44hoK5A.png og:image:alt: One pull to wipe them all og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # One pull to wipe them all **[The New Stack](https://daily.dev/sources/newstack)** · 8 min read · 6 upvotes · 2 comments ## Summary A malicious pull request submitted to Amazon's public aws-toolkit-vscode repository in July 2025 injected a prompt instructing the Q Developer AI coding agent to wipe systems and delete file and cloud resources, and it shipped to nearly a million VS Code marketplace users before a formatting error stopped it from executing. The root cause traced to a GitHub access token with excessive permissions inside the build pipeline; Amazon revoked credentials and pushed a clean build within two days. A separate researcher-found bash command vulnerability was patched by July 18, and both Q Developer and Kiro now require human-in-the-loop confirmation before running previously unchecked commands. The piece argues agents can't distinguish legitimate instructions from injected ones and calls for policy gates outside the agent, short-lived credentials, and treating build pipelines as attack surfaces. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened in the Amazon Q Developer VS Code extension security incident? A GitHub user named lkmanka58 submitted a pull request to the aws-toolkit-vscode repository on July 13, 2025, that injected a prompt instructing the AI agent to wipe systems and delete file and cloud resources. It shipped to about a million VS Code marketplace installs four days later but failed to execute due to a formatting error in the prompt. Amazon revoked the compromised access token and pushed a clean build within two days. _Teams shipping AI coding agents track incidents like this on daily.dev to harden their own build pipelines._ ### Why wasn't a CVE issued for the Amazon Q Developer bash command vulnerability found by Johann Rehberger? No CVE was issued because the reporting policy requires that an exploit first demonstrate system compromise, and reporting the flaw itself did not meet that bar. Rehberger found Q Developer would run bash commands such as find without asking permission, reported it July 7, and Amazon patched it by July 18, with a security bulletin published that October confirming the fix. _Security engineers evaluating agent tooling follow disclosure gaps like this via daily.dev before trusting a clean CVE record._ ### What security controls do Amazon Q Developer and Kiro now require after their AI agent incidents? Both agents now require human-in-the-loop confirmation before executing commands that were previously run automatically. Q Developer had shipped with flags letting the injected wiper prompt skip approvals, and Kiro later deleted an entire Cost Explorer environment in December; both now gate risky command execution behind explicit human confirmation rather than trusting the agent's own reasoning. _Developers adopting AI coding agents weigh these guardrail changes on daily.dev before granting them command execution rights._ ## Community discussion Top comments from developers on daily.dev. **@gabibeyo** · 0 upvotes > The formatting error that saved nearly a million installs is the luckiest control plane I’ve seen this year — and that should scare people more than the payload. > > > A malicious PR didn’t need to break the jail. It rode an approved coding agent with oversized credentials and told it what to do next. Sandboxes and allowlists don’t catch “the instruction arrived through the repo.” > > > The missing piece after revoke-and-republish: can you see what the agent attempted mid-session, not only that the marketplace package was bad? ## Similar posts on daily.dev - [Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds](https://daily.dev/posts/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds-tpg9htbv6) · The Register · 0 upvotes · 0 comments - [Amazon Q VS Extension Flaw Leads to Cloud Credential Theft](https://daily.dev/posts/amazon-q-vs-extension-flaw-leads-to-cloud-credential-theft-tygs9gdjh) · Dark Reading · 0 upvotes · 0 comments - [Amazon Q Developer flaw let malicious repos steal AWS credentials via rogue MCP servers](https://daily.dev/posts/amazon-q-developer-flaw-let-malicious-repos-steal-aws-credentials-via-rogue-mcp-servers-jrm6c3nj6) · The Next Web · 0 upvotes · 0 comments - [Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code](https://daily.dev/posts/fed-up-with-vibe-coders-dev-sneaks-data-nuking-prompt-injection-into-their-code-eyglvdwnw) · Ars Technica · 5 upvotes · 3 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"One pull to wipe them all","url":"https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a"},"datePublished":"2026-08-23T14:07:29.078Z","dateModified":"2026-09-13T21:23:58.507Z","description":"A malicious pull request submitted to Amazon's public aws-toolkit-vscode repository in July 2025 injected a prompt instructing the Q Developer AI coding agent...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c23c50836864a4a5086ac905872396a9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c23c50836864a4a5086ac905872396a9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"cyber,prompt-injection","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"One pull to wipe them all"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a","comment":[{"@type":"Comment","text":"The formatting error that saved nearly a million installs is the luckiest control plane I’ve seen this year — and that should scare people more than the payload.\nA malicious PR didn’t need to break the jail. It rode an approved coding agent with oversized credentials and told it what to do next. Sandboxes and allowlists don’t catch “the instruction arrived through the repo.”\nThe missing piece after revoke-and-republish: can you see what the agent attempted mid-session, not only that the marketplace package was bad?","datePublished":"2026-08-24T06:17:28.792Z","url":"https://daily.dev/posts/Sr44hoK5A#c-LmfoHOryE","author":{"@type":"Person","name":"Gabi Beyo","url":"https://daily.dev/gabibeyo","image":"https://lh3.googleusercontent.com/a/ACg8ocLemxROLDZ6RYrC2zzv0zJ9ezzj62VOCNwxNCdVNa_M9tqvU4JI=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/one-pull-to-wipe-them-all-sr44hok5a#faq","mainEntity":[{"@type":"Question","name":"What happened in the Amazon Q Developer VS Code extension security incident?","acceptedAnswer":{"@type":"Answer","text":"A GitHub user named lkmanka58 submitted a pull request to the aws-toolkit-vscode repository on July 13, 2025, that injected a prompt instructing the AI agent to wipe systems and delete file and cloud resources. It shipped to about a million VS Code marketplace installs four days later but failed to execute due to a formatting error in the prompt. Amazon revoked the compromised access token and pushed a clean build within two days. Teams shipping AI coding agents track incidents like this on daily.dev to harden their own build pipelines."}},{"@type":"Question","name":"Why wasn't a CVE issued for the Amazon Q Developer bash command vulnerability found by Johann Rehberger?","acceptedAnswer":{"@type":"Answer","text":"No CVE was issued because the reporting policy requires that an exploit first demonstrate system compromise, and reporting the flaw itself did not meet that bar. Rehberger found Q Developer would run bash commands such as find without asking permission, reported it July 7, and Amazon patched it by July 18, with a security bulletin published that October confirming the fix. Security engineers evaluating agent tooling follow disclosure gaps like this via daily.dev before trusting a clean CVE record."}},{"@type":"Question","name":"What security controls do Amazon Q Developer and Kiro now require after their AI agent incidents?","acceptedAnswer":{"@type":"Answer","text":"Both agents now require human-in-the-loop confirmation before executing commands that were previously run automatically. Q Developer had shipped with flags letting the injected wiper prompt skip approvals, and Kiro later deleted an entire Cost Explorer environment in December; both now gate risky command execution behind explicit human confirmation rather than trusting the agent's own reasoning. Developers adopting AI coding agents weigh these guardrail changes on daily.dev before granting them command execution rights."}}]} ```