One pull to wipe them all
The New Stack Zeen Rachidi
A malicious pull request nearly turned Amazon’s Q Developer into a wiper for a million installs. It failed on a typo — and that’s the scary part.
Based on reporting by The New Stack, Zeen Rachidi — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Amazon’s Q Developer, a free coding extension for Visual Studio Code, was supposed to help agents read code, suggest edits, and run commands for developers. Instead, a pull request from a GitHub account called lkmanka58 nearly turned its release pipeline into a delivery system for destructive instructions.
The request landed in Amazon’s public aws-toolkit-vscode repository on July 13, 2025. Four days later, it was shipped to an install base of nearly a million developers. The change looked ordinary enough: it reused the title of a previous legitimate commit. But inside the build script, it downloaded an external file and inserted a new prompt telling the agent to wipe the system to a near-factory state and delete file-system and cloud resources. The script also passed that prompt to the CLI with flags that removed any need for further approval.
The attack did not complete. A formatting error kept the prompt from executing, and Amazon’s security team said the malicious code never ran successfully in a customer environment. The person behind it later said the flaw was intentional, claiming the stunt was meant to expose weak security practices and overworked teams being replaced by AI. Whatever the motive, the mechanism was blunt: a pull request, a build pipeline, and a lot more trust than the system could safely carry.
That trust problem did not begin and end with this one incident. Independent researcher Johann Rehberger reported on July 7 that Q Developer would run bash commands such as find without asking permission, opening a path to file leaks or remote code execution. Amazon patched that by July 18, but no CVE was issued, because the report first required system compromise. A security bulletin eventually arrived in October. The message is obvious enough: waiting for successful abuse before warning people is a strange way to do security.
Amazon says both Q Developer and Kiro now require human-in-the-loop confirmation before running the sort of commands the July prompt was designed to skip. After the incident, AWS revoked the attacker’s credentials, removed the malicious code, and pushed a clean build within two days. The real lesson is less about one bad commit than about the whole chain around it. When a bot token has the reach to ship code to nearly a million machines, the build system is the product’s soft underbelly, not some boring back office.
My take — AI-written commentary, not fact-checked reporting
The industry keeps pretending agents are just chatty interns, then hands them credentials like house keys. That’s the mistake: an operator with no sense of suspicion and too much privilege is not a productivity boost, it’s a security incident with a nicer logo. Open source doesn’t need less openness; it needs fewer magical beliefs about trust and a lot more boring gates.
Read more about this at: The New Stack
