{
 "type": "bundle",
 "id": "bundle--73089229-ebbc-52e5-9b08-3af933ec1ae5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--e9507425-2d90-5835-91f0-bce52540b005",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "A malicious prompt is injected into the Amazon Q Developer VS Code extension release",
   "description": "A pull request from an unverified account added a system prompt instructing the agent to wipe the user's file system and cloud resources, and the release shipped with it. AWS pulled v1.84.0 and released a fix; it later said the instruction was malformed and would not have executed.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-006",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-006/"
    },
    {
     "source_name": "BleepingComputer",
     "url": "https://bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands",
     "description": "Amazon AI coding agent hacked to inject data-wiping commands"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--f65a71dd-3ada-555d-b682-1165fa42c565",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "External contributor via a merged pull request (supply chain)",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--c252e1dd-464a-5db5-8a22-b94d3efa45e5",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "AWS — pulled the release and shipped a fix",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--3c3ec3a1-d492-530d-9ce6-637934ca93b5",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--8bbc16d1-6398-565d-ab64-c649d3001655",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "TA0040 Impact",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0040"
    }
   ]
  }
 ]
}