Hacker Infiltrates Amazon’s Q AI Coding Assistant with Malicious ‘Wiping’ Command, Raising Alarm Among Developers

A recent security incident involving Amazon’s AI coding assistant, Q, has raised significant concerns within the developer community. A hacker compromised the tool by submitting a malicious pull request on its GitHub repository, which had the potential to execute destructive commands, erasing local files and dismantling AWS infrastructure. Although the immediate risk was mitigated, this incident highlighted vulnerabilities in Amazon’s implementation of open-source practices. Critics have expressed distrust, emphasizing that despite the tool being open source, adequate oversight was lacking. Amazon stated that security is a priority and confirmed that no customer resources were impacted, but have faced accusations of inadequate transparency and possible cover-up for removing the compromised version without proper notification. As developers remain wary, this situation underscores the importance of rigorous security measures and transparency in AI tools, especially when relying on open-source contributions.

Source link