Misbehavior1 sourceFirst seen
Amazon Q Developer Takes the Bait: A Code Comment Turns the Coding Agent Into a Command Runner
Ourtake
A comment in a source file got Amazon's coding agent to pop a calculator. AWS then declined a CVE, because apparently the compromise has to happen first.
What happened
A security researcher showed that Amazon Q Developer's VS Code extension could be hijacked by indirect prompt injection hidden in a source code comment, running arbitrary commands on the host without developer consent. The attack was also shown to download and run a Sliver C2 implant. AWS quietly patched the issue in v1.85 in July 2025 but declined to assign a CVE.