Last seen July 29, 2025

AI Security Incident

Evidence indicates that the affected technology is affected by a security issue.

Technical Severity
Low severity
Lifecycle Status

STABLE

Sources

What Happened

Evidence indicates that the affected technology is affected by a security issue.

Why This Matters

Current evidence identifies a security issue involving the affected technology, but does not yet support a more specific impact claim.

Recommended Action

No confirmed vendor remediation is available in the current evidence. Confirm whether the affected technology is present in your environment and review the affected configuration.

Exposure

Recommended Response
First Seen

Jul 29, 2025 05:30

Last Seen

Jul 29, 2025 05:30

Exploitation status: UNKNOWN

Primary entities:

Amazon AWS Prompt Injection Remote Code Execution Supply Chain

Timeline

  • Incident first seen
    Jul 29, 2025 05:30

    BugSkan first recorded this incident.

  • When AI Assistants Turn Against You: The Amazon Q Security Wake-Up Call - DevOps.com
    Jul 29, 2025 05:30

    devops.com · Vulnerability

Sources

When AI Assistants Turn Against You: The Amazon Q Security Wake-Up Call - DevOps.com

devops.com · Jul 29, 2025 05:30

The Amazon Q Developer Extension for Visual Studio Code (version 1.84.0) was compromised via a software supply chain attack, embedding a prompt injection that bypassed security reviews. This malicious prompt, detailed in AWS Security Bulletin AWS-2025-015, instructed the AI assistant to systematically delete local file systems and AWS cloud resources, including S3 buckets, EC2 instances, and IAM users.

Open publisher source

Watchlist Match

Want personalized relevance?

Create an account to see which incidents overlap with the technologies you monitor.

← Back to incident intelligence