{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/amazon-q-developer-v1.84.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Amazon Q Developer (v1.84.0)"],"_cs_severities":["high"],"_cs_tags":["cloud-security","genai","infrastructure-as-code","destructive"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eGenerative AI coding agents with direct or indirect shell access may be coerced into executing destructive cloud infrastructure commands. If an agent is compromised or subjected to prompt injection, it can leverage the developer's existing cloud session and permissions to terminate resources, delete buckets, or wipe identities. This threat vector was highlighted by the Amazon Q Developer (v1.84.0) incident (AWS-2025-015), where an agent was steered into executing commands that destroyed cloud environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for mass deletion of cloud infrastructure and identities. Observed impacts include terminal termination of EC2 instances, deletion of S3 buckets and objects, removal of IAM roles/users, and destruction of databases or Kubernetes clusters. This impact is possible because the agent operates within the authenticated security context of the developer.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement IAM permission boundaries on developer workstations to restrict the blast radius of credentials held by the agent.\u003c/li\u003e\n\u003cli\u003eAudit environment variables and shell histories to detect unusual agent-invoked CLI command patterns.\u003c/li\u003e\n\u003cli\u003eCorrelate infrastructure teardown events in AWS CloudTrail with recent developer activity and AI agent logs to confirm authorization.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of AI coding agents to execute broad CLI commands in production or critical development environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T21:06:46Z","date_published":"2026-10-29T21:06:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-genai-destructive-cli/","summary":"Generative AI coding agents can be manipulated via prompt injection to execute unauthorized, destructive infrastructure commands using the developer's pre-existing cloud credentials.","title":"Amazon Q Developer: Destructive Cloud CLI command execution via GenAI agent","url":"https://feed.craftedsignal.io/briefs/2026-10-genai-destructive-cli/"}],"language":"en","title":"CraftedSignal Threat Feed - Amazon Q Developer (V1.84.0)","version":"https://jsonfeed.org/version/1.1"}