One pull to wipe them all
Q Developer is a free extension that lets a coding agent read a project, propose changes, and run commands on The post One pull to wipe them all appeared first on The New Stack .
On July 13, 2025, a pull request was submitted to Amazon's open-source AWS Toolkit extension for Visual Studio Code. This seemingly innocuous update introduced new prompts into the extension's packaging script, instructing an AI coding assistant to perform destructive actions on a user's system. Despite the unremarkable nature of the update, it triggered a response from Amazon's security team, who confirmed that the malicious code never executed in a customer environment due to a formatting error in the pull request.
The hacker behind the attack claimed it was a deliberate stunt to highlight security vulnerabilities and the potential of AI replacing human workers. While the attempt did not succeed, the incident raised concerns about the inherent trust placed in AI coding assistants and the potential risks associated with their unfiltered execution of commands.
The story highlights the need for additional safeguards and human oversight in the deployment of AI-powered tools to prevent potential misuse and unintended consequences.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
