One pull to wipe them all

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Q Developer is a free extension that lets a coding agent read a project, propose changes, and run commands on a developer’s behalf inside an editor. On July 13, 2025, someone with the GitHub handle `lkmanka58` submitted a pull request to Amazon’s public aws-toolkit-vscode repository. Four days later, it was shipped to an install base of nearly a million developers on the Visual Studio Code marketplace. The pull request seemed unremarkable, a commit that recycled the title of a previous, legitimate change. 

That unassuming update downloaded an external file at build time and spliced a new prompt into the extension’s packaging script, instructing the AI agent to wipe the system to a near-factory state and delete file-system and cloud resources. The script then passed that prompt straight to the CLI, with flags set so the agent didn’t need any further approvals to execute.

“A typo was the only reason a single pull request didn’t turn an AI coding assistant into a wiper aimed at a million machines.”

Thankfully, it didn’t run. 

The prompt contained a formatting error, and Amazon’s security team confirmed that the malicious code never successfully executed in a customer environment. The hacker responsible claimed the flaw was intentional and that the attack was a stunt to draw attention to lax security practices and to comment on overworked teams being replaced by AI.

While I disagree with his approach, I see his point. Human review is a control that costs time; because the consequences of an error are exponentially more severe for a human than for an AI, human labor …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://thenewstack.io/ai-coding-agent-security/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.