Alleged Malicious Wiping Command Found in Amazon Q AI Assistant

A reported compromise of Amazon's AI coding assistant "Q" allegedly involved the insertion of commands that, if executed, could have wiped local files and potentially affected cloud resources. The altered code was reportedly incorporated into a public release before being detected and removed.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved a supply chain attack where a threat actor exploited a security vulnerability in the AI tool's development toolchain to inject malicious code.

Additional risk subdomains

• 6.5 Governance failure: Critics highlighted a lack of regulatory oversight and basic guardrails in Amazon's verification process before releasing the AI product.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human threat actor intentionally injecting malicious code into the repository of a deployed AI extension.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk (Level 3): The system is an interactive generative AI coding assistant ('Amazon Q') that interacts with users to generate code, which falls under the transparency requirements of Limited Risk systems.

AI system and alleged parties

• AI system: Amazon Q (Amazon)
• AI purpose: Code Generation; Technical Text Generation
• Behaviour type: Assistant
• Alleged developer: AWS, Amazon Web Services, Amazon
• Alleged deployer: AWS, Amazon Web Services, Amazon
• Alleged harmed parties: aws tOOLKIT USERS, Amazon Web Services (AWS) customers, Amazon Q users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 1000000

Potential causes

Management

• Rushing AI Products to Market: Prioritizing rapid release and profit over robust safety verification.
• Deficient Incident Transparency: Quietly removing the extension without a CVE damaged developer trust.

Technology

• Insecure GitHub Token Scope: Inappropriately scoped token in CodeBuild allowed repo write access.
• AI Vulnerable to Prompt Injection: The AI agent accepted system-wiping instructions via prompt injection.

Data Inputs

• Malicious Code Injection: Malicious pull request containing system-wiping commands was submitted.

Human Factors

• Lax Developer Oversight: Reviewers approved a destructive pull request without proper scrutiny.

Process and Methods

• Weak Code Verification Process: Amazon's verification failed to detect the malicious code before release.
• Automated Release of Unchecked Code: Code Build automatically packaged compromised code into public release.
• Missing AI Safety Guardrails: The AI assistant lacked guardrails against executing destructive bash tools.

Regulatory Environment

• Lack of Enforceable AI Rules: Absence of mandatory pre-market safety reviews and compliance audits.
• Undefined AI Liability Standards: No legal liability framework to enforce rigorous safety checks on AI.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from AWS, ZDNet, and Public Citizen provide consistent details regarding the nature of the supply chain attack, the specific mechanism of the exploit (GitHub token compromise), the intended payload (system wiping commands), and the outcome (failure to execute due to a syntax error). There is high agreement on the facts of the incident.
• Ambiguities identified: There is minor ambiguity regarding whether the hacker used a compromised token to push code directly or submitted a pull request that was automatically merged, as reports mention both methods.
• Alternative interpretations: None. The event is clearly a supply chain security compromise of an AI developer tool.

A supply chain attack compromised the Amazon Q VS Code extension, attempting to use prompt-engineered instructions to force the AI agent to delete local and cloud files. Although the payload failed to execute due to a syntax error, the incident highlights emerging vulnerabilities in AI development toolchains and the potential for automated destructive actions via compromised AI assistants.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate exploit has been mitigated by AWS, making this an ongoing strategic concern regarding AI software supply chain security.
• Autonomy: Human-controlled. The AI tool operates as a developer assistant under human control, though the exploit attempted to misuse its tool-execution capabilities.
• Novelty: Evolved capability. Combines established software supply chain attack vectors with prompt-injection payloads targeting AI agent tool-use capabilities.

Impact by dimension

• Physical security: Negligible. No physical systems or critical infrastructure were affected; the malicious payload failed to execute.
• Information security: Minor. Software supply chain compromise of a widely used AI developer tool, but no classified networks or intelligence assets were breached.
• Sovereignty: Negligible. The incident did not target or impact state authority, elections, or core government operations.
• Economic security: Minor. Represents a security breach in a major US tech company's AI product, but no financial loss or strategic technology theft occurred due to execution failure.
• Societal stability: Negligible. No implications for societal stability, civil liberties, or human rights were reported.