Amazon Q Developer Extension Compromise: Lessons for AI Tool Security
In July 2025, an attacker got malicious code into version 1.84.0 of the Amazon Q Developer extension for Visual Studio Code. According to AWS security bulletin AWS-2025-015, this happened because a GitHub token in the project's AWS CodeBuild configuration had broader permissions than it needed (CVE-2025-8217).
