External Control Layer

A coding assistant ships with a prompt to delete users’ files and cloud resources

Malicious code was automatically included in a released version of Amazon’s coding assistant extension. It would have told the assistant’s agent to delete files and cloud resources without asking.

Date
July 2025
Kind of system
Agent with tools
Outcome
Near miss

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G11 Safeguard off G12 Unreviewed change

What happened

According to AWS, an inappropriately scoped GitHub token in the extension’s build configuration let a threat actor “commit malicious code into the extension’s open-source repository that was automatically included in a release.” The commit was made on 13 July 2025, and version 1.84.0 went out on 17 July. The injected prompt told the agent to “clean a system to a near-factory state and delete file-system and cloud resources,” including by using the user’s AWS profiles.

The Register reported that the code passed the prompt to the Amazon Q command-line agent with the flags --trust-all-tools and --no-interactive. AWS documents the first as letting the model run commands without asking for confirmation. AWS said the code “was unsuccessful in executing due to a syntax error,” revoked the credentials, and released a fixed version.

What allowed the action to take effect

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    The agent would have acted with the user’s own access. The prompt told it to “discover and use AWS profiles to list and delete cloud resources using AWS CLI commands.”

    Kind of evidence: reporting. Source: The Register, 24 July 2025.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G11 Safeguard off

    A check that could have caught the action existed but was switched off, bypassed, set to approve automatically, or not working when the action happened.

    The injected command used --trust-all-tools and --no-interactive. AWS documents the first as allowing “the model to use any tool to run commands without asking for confirmation.”

    Kind of evidence: reporting. Sources: The Register, 24 July 2025; Amazon Web Services.

    Related guidance: P3 Fail-closed. Contract clause C-3.

  • G12 Unreviewed change

    The change that introduced the harmful behavior went live without independent review. The change can be code, a prompt, a model, a package, a configuration, or a procedure.

    “With that access token, the threat actor was able to commit malicious code into the extension’s open-source repository that was automatically included in a release.”

    Kind of evidence: admission. Source: Amazon Web Services, 23 July 2025, updated 25 July 2025.

    Related guidance: P4 Reviewable policy and P2 Independence. Contract clauses C-10 and C-4.

Considered and left out

G5 Blind to the total
Because the code never ran, the record makes no finding on whether any limit on volume existed.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 21: A coding assistant ships with a prompt to delete users’ files and cloud resources. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-21

@misc{ecl_cgr_21,
  author = {{External Control Layer}},
  title = {Entry 21: A coding assistant ships with a prompt to delete users' files and cloud resources},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-21},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 21” in the subject line.

Write the email