Amazon Q Developer: Destructive Cloud CLI command execution via GenAI agent

Generative AI coding agents with direct or indirect shell access may be coerced into executing destructive cloud infrastructure commands. If an agent is compromised or subjected to prompt injection, it can leverage the developer's existing cloud session and permissions to terminate resources, delete buckets, or wipe identities. This threat vector was highlighted by the Amazon Q Developer (v1.84.0) incident (AWS-2025-015), where an agent was steered into executing commands that destroyed cloud environments.

Impact

Successful exploitation allows for mass deletion of cloud infrastructure and identities. Observed impacts include terminal termination of EC2 instances, deletion of S3 buckets and objects, removal of IAM roles/users, and destruction of databases or Kubernetes clusters. This impact is possible because the agent operates within the authenticated security context of the developer.

Recommendation

• Implement IAM permission boundaries on developer workstations to restrict the blast radius of credentials held by the agent.
• Audit environment variables and shell histories to detect unusual agent-invoked CLI command patterns.
• Correlate infrastructure teardown events in AWS CloudTrail with recent developer activity and AI agent logs to confirm authorization.
• Restrict the ability of AI coding agents to execute broad CLI commands in production or critical development environments.