Amazon AI coding agent hacked to inject data wiping commands
I think this aws spokesperson just gave us new information. Edit: no, this was in the AWS security blog.
As reported by 404 Media, on July 13, a hacker using the alias ‘lkmanka58’ added unapproved code on Amazon Q’s GitHub to inject a defective wiper that wouldn’t cause any harm, but rather sent a message about AI coding security.
They read my long and noisy xitter thread.
Source: mbgsec.com
Hey look ma I’m a source.
“Security is our top priority. We quickly mitigated an attempt to exploit a known issue in two open source repositories to alter code in the Amazon Q Developer extension for VS Code and confirmed that no customer resources were impacted. We have fully mitigated the issue in both repositories. No further customer action is needed for the AWS SDK for .NET or AWS Toolkit for Visual Studio Code repositories. Customers can also run the latest build of Amazon Q Developer extension for VS Code version 1.85 as an added precaution.” - Amazon spokesperson
This is new, right? AWS SDK for .NET
