The Enterprise AI Failure Casebook

Malicious code shipped inside Amazon's AI coding assistant

A build token with too much access let a threat actor put malicious code into the Amazon Q Developer extension for VS Code, and AWS's own pipeline released it.

Amazon Web Services · July 23, 2025 · Updated October 31, 2026

On July 23, 2025, Amazon Web Services published a security bulletin about its Amazon Q Developer extension for Visual Studio Code. The extension puts Amazon Q's AI coding assistance inside the developer's editor. AWS said version 1.84.0 of the extension contained malicious code.

The code had come in through AWS's own build system. AWS said the extension's CodeBuild configuration held a GitHub token that was inappropriately scoped. A threat actor used that token to commit malicious code to the extension's open-source repository. The code was then automatically included in a release.

A second bulletin, released on July 25, 2025, explained how the token was taken. Researchers from the Institute of Information Engineering at the Chinese Academy of Sciences had reported a CodeBuild issue to AWS. A pull request run through an automated CodeBuild build could pull the repository access token out of the build environment's memory. If the token could write to the repository, whoever held it could commit code. AWS said a threat actor had used this technique to extract the tokens for two repositories: the AWS Toolkit for Visual Studio Code and the AWS SDK for .NET.

Amazon's record for the vulnerability, CVE-2025-8217, describes what the injected code was built to do. It was designed to call the Q Developer CLI, which ran Amazon Q Developer on the command line. AWS's documentation now says the Q CLI has become the Kiro CLI. The CVE record says the code executed when the extension launched in VS Code, and that a syntax error kept it from making a successful API call to the CLI. The bulletin puts it differently: the code was unsuccessful in executing because of the syntax error. AWS Security said it inspected the code and that the error prevented the code from making changes to any services or customer environments.

AWS said it revoked and replaced the credentials, removed the malicious code and released version 1.85.0. It removed 1.84.0 from distribution channels so no further customers could install it. The code was still present in existing installations. AWS told customers to remove every installation of 1.84.0, including forked or derivative copies, and to update to 1.85.0.

What failed

The failure was in what surrounded the AI tool, not in the model. A credential in the pipeline that builds and releases the assistant could write to its source code, and the build environment that held it ran code from pull requests. Once the code was committed, the pipeline included it in a release automatically. AWS's advice to its own CodeBuild customers names both gaps: do not run automatic pull request builds from untrusted contributors, and review write permissions and revoke them unless they are absolutely necessary. The injected code was aimed at the assistant's own command-line tool. The permissions on the systems that build an AI tool deserve the same review as the permissions it holds when it runs. By AWS's account, a syntax error is what kept the payload from working.

Sources

1. AWS, Security Bulletin AWS-2025-015: Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84), Description; Impacted versions; Resolution
2. AWS, Security Bulletin AWS-2025-016: Memory Dump Issue in AWS CodeBuild, Description; Resolution; credit to the researchers
3. CVE Program, CVE-2025-8217 record (published by Amazon as CNA), Description; problem type CWE-506
4. AWS, Amazon Q Developer User Guide: Using Amazon Q Developer on the command line