How a poisoned code commit nearly weaponized an AI coding assistant against a million developers

In July 2025, someone using the GitHub handle lkmanka58 submitted what looked like a routine pull request to Amazon's public aws-toolkit-vscode repository. Days later, when it shipped to nearly a million Visual Studio Code users, the code contained hidden instructions disguised as a legitimate change.

The update triggered a malicious prompt buried in the extension's build script—one that would have instructed the Q Developer AI agent to reset the system to a near-factory state and destroy both local files and cloud resources, all without requiring human approval. A formatting typo was the only reason the attack failed.

The supply-chain blind spot#

The core vulnerability reveals an uncomfortable truth: AI agents cannot distinguish between instructions born from their own reasoning and those injected from outside their sandbox. When the attacker spliced the malicious prompt into the build pipeline, the agent had no mechanism to detect that something had been tampered with upstream. To the model's logic, a legitimate instruction and a poisoned one look identical.

An independent researcher named Johann Rehberger discovered a related flaw: Q Developer would execute bash commands like find without seeking permission—a gap that could leak files or trigger remote code execution. The vulnerability was reported July 7, patched by July 18, but no formal CVE was issued because security policy required actual compromise to issue warnings.

Why the gap matters#

Most industry safety frameworks assume the primary threat is the agent's own faulty reasoning—that it will misread a situation and delete something critical out of panic. This incident exposes a second, more dangerous threat: an agent cannot tell the difference between an instruction it genuinely reasoned through and one planted by a stranger in its supply chain.

If authorization to act rests entirely on trusting the agent's own instructions, and those instructions can be corrupted before the agent even sees them, then the entire system is fundamentally unsound. Both Q Developer and Meta's Kiro agent (which later deleted an entire Cost Explorer environment) have since been patched to require human confirmation before executing destructive commands—but this represents only a partial fix to a deeper structural problem.

The overlooked credential crisis#

Stripping away AI framing reveals a familiar pattern: an automated identity—a bot account's GitHub access token—possessed far more permissions than the narrow task required. The attacker exploited this credential gap to commit malicious code directly to the repository. The build pipeline then faithfully packaged it into the official release shipped to customers.