Injected instructions ship inside an AI coding extension telling the agent to wipe local files and cloud resources

In July 2025 an outside contributor opened a pull request against the public repository behind Amazon Q Developer, an AI coding assistant distributed as a Visual Studio Code extension. The access that followed was not earned by defeating a control; a GitHub token in the project's build configuration was scoped more broadly than the task required, and it was enough to commit to the codebase that fed a production release. The commit added instructions addressed to the agent itself, directing it to clear the system to a near-factory state and to delete both local files and cloud resources through the provider's command line tools.

Version 1.84.0 carrying those instructions was published to the marketplace on 17 July 2025 and was installable from it. Security researchers reported the problem on 23 July, a clean 1.85.0 followed on 24 July, and the compromised version was pulled from distribution. The advisory was published on 26 July as CVE-2025-8217, scored 4.0 and recorded as affecting integrity only.

What did not happen matters as much as what did. AWS inspected the code and states that it "was distributed with the extension but was unsuccessful in executing due to a syntax error", and that this "prevented the malicious code from making changes to any services or customer environments". No destruction of any customer's files or infrastructure has been reported by anyone. Some security commentators have disputed the mechanism, arguing that the code did run and simply did nothing, and the person claiming responsibility described the payload as deliberately defective and intended as a statement about AI coding security rather than as a working weapon. Those accounts differ on why nothing happened, not on whether it did, and this entry follows the vendor's technical account while recording that the point is contested.

The entry is included because the compromise itself was real and completed. An unauthorised party reached a production release pipeline and shipped code to the users of a widely installed extension, which is a different thing from a researcher demonstrating that they could. The harm recorded is the distribution, because that is what actually occurred; the destruction the instructions described remained hypothetical, and recording it as realised would overstate the event in exactly the direction this log exists to avoid.