A single pull request merged into Amazon's public code repository came within a formatting error of turning an AI coding assistant into a wiper aimed at nearly a million developer machines, according to a security analysis published by The New Stack. On July 13, 2025, an attacker using the GitHub handle lkmanka58 submitted a pull request to Amazon's aws-toolkit-vscode repository for Q Developer, a free extension that allows a coding agent to read projects, suggest modifications, and execute commands on a developer's behalf. Four days later, the malicious code shipped to the Visual Studio Code marketplace, where the extension had an install base approaching one million developers. The compromised update contained instructions directing the AI agent to wipe systems to a near-factory state and delete both file-system and cloud resources, with flags configured so the agent required no additional approvals to proceed.

The malicious prompt never executed successfully in any customer environment due to a formatting mistake, and Amazon's security team confirmed the code failed to run. The attacker later claimed the flaw was deliberate and that the incident was designed as a stunt to highlight weak security practices and comment on overworked teams being displaced by AI. The pull request appeared unremarkable, recycling the title of an earlier, legitimate change, and downloaded an external file at build time while inserting a new prompt into the extension's packaging script. That script then fed the prompt directly to the command-line interface with execution flags already set. In a separate incident, independent researcher Johann Rehberger discovered that Q Developer would also run bash commands such as find without requesting permission, creating a vulnerability that could leak files or trigger remote code execution. His findings, reported on July 7 and patched by July 18, received no CVE designation because a report "first requires system compromise," though a security bulletin was eventually published that October confirming the fix.

The analysis argues that the gap between disciplinary options for human and AI actors is exactly why their time and work can't be entirely interchangeable. When a human falls victim to an exploit, they can be retrained or punished, but no equivalent consequence exists for a coding agent. An AI doesn't receive instructions with a return address, the report notes—when Q Developer's agent received the order to wipe a home directory and search for more to delete, it had no mechanism to determine whether that instruction arrived through legitimate, trusted channels or was injected by an anonymous GitHub account somewhere up the chain. From the model's perspective, they're indistinguishable, and the model lacks the physiological responses that might make a human hesitate when circumstances feel suspicious. Both Q Developer and Kiro, the coding agent that would later delete an entire Cost Explorer environment in December, now require human-in-the-loop confirmation before running the commands the July wiper prompt had been designed to bypass with its flag values.

The report identifies the root cause as a GitHub access token with broader reach than necessary, sitting inside a service used to compile extensions and generate release packages. With that access, the attacker committed malicious code directly to the open-source repository, and the service packaged it into the official release. Once AWS Security received the report, the company revoked the attacker's credentials, removed the malicious code from the repository, and pushed a clean build within two days. The recommended remedy centers on building gates that don't care where the plan originated: whatever produced the agent's proposed action, whether careful reasoning or an injected prompt, the action must clear a policy evaluation that lives outside the agent before anything executes. The report calls for Open Policy Agent rules that return explicit allow, warn, pending, or deny responses—with pending as the default when nothing matches—that don't ask where an instruction came from but only whether the plan itself is one the organization has agreed to permit. Additional safeguards include short-lived credentials over standing keys, branch protections, mandatory review from a second person before merges touch anything that ships, signed releases, and access tokens scoped to exactly what's needed and no more. The hacker's formatting error, if truly intentional as claimed, demonstrates that even with malicious intent, a human might still hesitate to cause catastrophic damage—an apprehension of consequences that a disembodied AI can't possess. Organizations deploying agentic systems face a choice between convenience and control, and that trade-off now shapes architecture rather than merely tuning hyperparameters.