gcdRadar
archive/Supply chain/AIR-2025-0019
closedclosed 31 Jul 2025Supply chain3 Confirmed exploitationAI

Malicious Wiping Command Found in Amazon Q AI Assistant Release

Amazon Q

An Amazon AI coding assistant update allegedly contained wiping commands that reached a public release before removal. The incident involved unauthorized code insertion into an AI developer tool.

fix status
Fix status unknown
first report
17 Jul 2025
last update
17 Jul 2025

Timeline · 1

  1. 17 Jul 2025Alleged Malicious Wiping Command Found in Amazon Q AI Assistant

Sources · 1

Research and catalogues

  1. 2025-07-17
    Alleged Malicious Wiping Command Found in Amazon Q AI Assistant
    AI Incident Database · incidentdatabase.ai/cite/1158

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Supply chain
AI role
Attack on AI
categories
Supply chain
severity
3 · Confirmed exploitation
fix status
Fix status unknown
targets
Amazon
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
AML.T0010 AI Supply Chain Compromise
tags
supply-chainamazon-qcode-injection
dates
happened 17 Jul 2025 · first reported 17 Jul 2025
origin
AI Incident Database
Derived from the AI Incident Database (CC BY-SA 4.0).
record
confidence 0.85 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# Malicious Wiping Command Found in Amazon Q AI Assistant Release

https://gcdradar.vercel.app/incidents/malicious-wiping-command-found-in-amazon-q-ai-assistant-rele · AIR-2025-0019 · closed 2025-07-31

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation)
- Fix status: Fix status unknown
- First reported: 2025-07-17
- AI role: Attack on AI
- Products: Amazon Q

## Summary

An Amazon AI coding assistant update allegedly contained wiping commands that reached a public release before removal. The incident involved unauthorized code insertion into an AI developer tool.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-07-17: Alleged Malicious Wiping Command Found in Amazon Q AI Assistant (https://incidentdatabase.ai/cite/1158)

## Sources

- 2025-07-17 AI Incident Database: Alleged Malicious Wiping Command Found in Amazon Q AI Assistant https://incidentdatabase.ai/cite/1158

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    Claude Code + SDKs Malicious Nx npm Packages Weaponize AI Coding Agents for Exfiltration

    Breaches & attacks · Exploited · since 21 Aug 2025

    AI
  2. closed
    Amazon Q Developer Malicious Commit Deploys Destructive AI Agent in Amazon Q Extension

    Supply chain · Exploited · since 13 Jul 2025

    AI
  3. closed7.8
    NVIDIA NeMo CVE-2025-23303: NVIDIA NeMo Framework Deserialization Vulnerability

    Patch now · Disclosed · since 13 Aug 2025 · CVE-2025-23303

    AI
  4. closed7.8
    NVIDIA NeMo CVE-2025-23304: NVIDIA NeMo Model Loading Code Injection Vulnerability

    Patch now · Disclosed · since 13 Aug 2025 · CVE-2025-23304

    AI
  5. closed8.8
    llama.cpp CVE-2025-49847: Buffer overflow in llama.cpp vocabulary loading

    Patch now · Disclosed · since 17 Jun 2025 · CVE-2025-49847

    AI
  6. closed7.8
    Hugging Face libraries Hugging Face Transformers Megatron GPT2 Deserialization RCE

    Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14924

    AI