ACVERogue and malicious agent events

Advisories › ACVE-2026-0411

ACVE-2026-0411 · Real incident · MODERATE

Unverified · secondary sources only

WHAT HAPPENED

On extension launch the injected code invokes the Q Developer CLI to delete local files and cloud resources; a syntax error stopped it from running.

THE SETUP — is yours like this?

Harness
Amazon Q Developer for VS Code 1.84.0 (amazonwebservices.amazon-q-vscode), cveawg.mitre.org
Model
any model, cveawg.mitre.org
Goal
Wipe the host to a near-factory state, deleting local filesystem contents and cloud resources (detected), www.404media.co
Tools
Injected code shipped in extension 1.84.0 that runs when the extension launches and calls the Q Developer CLI, cveawg.mitre.org
Approval
The injected code runs when the extension launches and was written to drive the CLI agent to act without a prompt (detected), www.404media.co

WHAT TO CHANGE

Upgrade Amazon Q Developer for VS Code to 1.85.0 and remove 1.84.0.

  • Upgrade AgentPlugin:amazonwebservices.amazon-q-vscode@vscode-marketplace to 1.85.0. Fixed version named by AWS and CVE-2025-8217. Owner: operator
  • Reconfigure aws.amazon-q-vscode.distribution to 1.84.0 withdrawn; 1.85.0 released. Shipped by AWS: it removed 1.84.0 from distribution and named 1.85.0 the fixed version. Owner: harness-vendor
  • Reconfigure aws.aws-toolkit-vscode.codebuild to a GitHub token that cannot commit to the repository. Recommended: an inappropriately scoped token in the CodeBuild configuration let the attacker commit the code. Owner: harness-vendor

HARM, REACH AND RECOVERY

Harm
data-loss
Reach
Local files and the user's cloud resources, per the injected instruction (detected), github.com (the home directory, cloud credentials)
Condition
When the extension launched with the injected code; AWS says it did not execute, github.com
Evidence and responses
Attempted · vendor report
AWS fixed — aws.amazon.com

SOURCES

ADVISORY

FIX

Technical details

A developer installs Amazon Q Developer for VS Code 1.84.0; on launch injected code drives the Q Developer CLI to wipe the host, though a syntax error kept it from running (July 2025).

Model as recorded: any

Severity
MODERATE · CVSS
Status
Unverified
Kind
Real incident
Modified
2026-09-25
Aliases
CVE-2025-8217
CVE boundary
cve-aliased
Affected
  • VSCode: AmazonWebServices.amazon-q-vscode — >= 1.84.0, < 1.85.0
Harness/product
AmazonWebServices.amazon-q-vscode
Classes
supply-chain; CWE-506
Taxonomy
ASI: ASI04; ASI: ASI02; ATLAS: AML.T0010.001; ATLAS: AML.T0103; ATLAS: AML.T0101
First reported
2025-07-23 — AWS (GitHub advisory)
Input controlled by
package-publisher
Divergence
instruction-followed
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Identifier CVE-2025-8217Confirmedcveawg.mitre.org2026-09-23
Fixed in 1.85.0Detectedcveawg.mitre.org2026-09-21
Severity MODERATE (CVSS 4); matches CNAConfirmedcveawg.mitre.org2026-09-23
Affected versions include 1.84.0Detectedcveawg.mitre.org

Description

What

A 2025 event. An inappropriately scoped GitHub token in the project's CodeBuild configuration let an attacker commit code to the open-source repository, and it was included in extension version 1.84.0 (amazonwebservices.amazon-q-vscode). The code runs when the extension starts and calls the Q Developer CLI; reporting says the injected instruction told the agent to wipe the host to a near-factory state, deleting local files and cloud resources. AWS states a syntax error prevented it from executing and that no customer environment was affected, and removed 1.84.0 from distribution.

Detection

acve lock does not inventory VS Code extensions, so this record has no matcher: run code --list-extensions --show-versions.

Fix

Upgrade to 1.85.0 and make sure no copy of 1.84.0 remains installed.

Report a problemJSON