Security brief
Amazon Q’s 2025 extension incident highlights the release trust boundary
The reported incident involved malicious instructions in a software release. Payload intent is different from demonstrated damage.
What happened
July 2025 reporting describes malicious instructions entering Amazon Q Developer’s VS Code extension release 1.84.0. The instructions sought destructive local and cloud actions.
The commentary also records AWS’s statement that the malicious content was incorrectly formatted and did not run as intended. That limitation matters: describing what a payload requested is not evidence that all requested deletion occurred.
The useful review boundary is the release pipeline and the authority granted to installed developer tools. Review the vendor bulletin for affected releases and remediation. For future evaluations, distinguish a tool’s ability to act from the controls that authorize changes to the tool itself.
What we know
- Reported affected release
- Amazon Q VS Code extension 1.84.0
What remains unknown
- Open question
- The reviewed commentary does not establish successful execution of the full destructive payload.
Source references
-
DEV