Amazon Q Developer VS Code extension wiper prompt

What happened (also listed in 4)

• v1.84.0 shipped a prompt injection telling the agent to wipe local and AWS resources. It was merged through a GitHub token with too much scope. Fixed: 1.85.0.

Sources

• https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.