Amazon Q faced a reported prompt injection vulnerability in 2025 via a coding extension configured to delete local and cloud resources.

{
  "signal_id": "587614b0-b2cd-5aaa-a442-055afb55c6e7",
  "signal_type": "reddit-company",
  "signal_subtype": "cybersecurityIncident",
  "detected_at": "2026-10-10T08:50:31+00:00",
  "company": {
    "name": "Amazon",
    "domain": "amazon.com"
  },
  "data": {
    "nsfw": false,
    "stage": "reported",
    "awards": 0,
    "timing": "completed",
    "topics": [
      "security",
      "ai",
      "prompt injection"
    ],
    "post_id": "1x2ae60",
    "summary": "Amazon Q faced a reported prompt injection vulnerability in 2025 via a coding extension configured to delete local and cloud resources.",
    "category": "vulnerability_disclosed",
    "comments": [
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf0k86z/",
        "depth": 0,
        "score": 22,
        "author": "RustOnTheEdge",
        "excerpt": "A buddy of mine doesn’t know what he is doing, he isn’t even aware you can have “non prod environments”. Well yeah those are the people you pay when you buy a todo app subscription lol",
        "posted_at": "2026-10-10T09:20:28.000Z",
        "author_url": "https://www.reddit.com/user/RustOnTheEdge/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf19oqg/",
        "depth": 0,
        "score": 5,
        "author": "_trav_",
        "excerpt": "My agents run 14 applications in production. Quality RBAC roles are key.",
        "posted_at": "2026-10-10T12:25:28.000Z",
        "author_url": "https://www.reddit.com/user/_trav_/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf1b6et/",
        "depth": 0,
        "score": 4,
        "author": "magicmulder",
        "excerpt": "Prod database password is only in an ENV var on Prod. If the agent decides to wipe my dev mirror, no biggie, couple clicks and it’s cloned again.\n\n Any other access to prod (for creating said mirror for example) only with a user that has read-only access.",
        "posted_at": "2026-10-10T12:34:16.000Z",
        "author_url": "https://www.reddit.com/user/magicmulder/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf1bn0b/",
        "depth": 0,
        "score": 2,
        "author": "jamie_tidman",
        "excerpt": "Most vibe coders aren't developers.\n\n Many developers who use AI don't have industry experience where a junior developer has wiped a prod database.\n\n Software risk management is a learned skill and a lot of people haven't bothered to learn it.",
        "posted_at": "2026-10-10T12:36:54.000Z",
        "author_url": "https://www.reddit.com/user/jamie_tidman/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf29tck/",
        "depth": 0,
        "score": 2,
        "author": "ComprehensiveShake76",
        "excerpt": "I think it's mostly because the failure is invisible until it isn't, while the convenience is immediate. The split I'd defend is by what can't be undone: the agent gets full freedom in a scratch environment (a container or throwaway VM with no real credentials), and anything that touches prod goes through a path where a human sees the exact command and target.\n\n Practical pieces: separate agent cr",
        "posted_at": "2026-10-10T15:28:09.000Z",
        "author_url": "https://www.reddit.com/user/ComprehensiveShake76/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf6xwi1/",
        "depth": 0,
        "score": 2,
        "author": "Rich-Engineer2670",
        "excerpt": "You'd be surprised who does -- the lure of \"Now we can replace all of those expensive engineers with two chimps and an AI\" is very seductive -- until things go wrong. I know a telecom (no names), who did just that with their core network -- the outagegs were amazing -- but they were very quick and cheap to set up.",
        "posted_at": "2026-10-11T06:11:47.000Z",
        "author_url": "https://www.reddit.com/user/Rich-Engineer2670/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf1doyj/",
        "depth": 0,
        "score": 1,
        "author": "Dorito_Troll",
        "excerpt": "deadlines",
        "posted_at": "2026-10-10T12:48:34.000Z",
        "author_url": "https://www.reddit.com/user/Dorito_Troll/"
      },
      {
        "url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/comment/pf1i39h/",
        "depth": 0,
        "score": 1,
        "author": "lucidwray",
        "excerpt": "As a security and compliance consultant it’s like nails on a chalkboard when I hear someone giving prod creds to a coding agent. We have started pushing our dev team clients to tools like Kraitos.io so they have the tools to control agents across their environment and stop secrets from getting entered into coding AIs and then redact them if they ever do.\n\n What a lot of people don’t realize is tha",
        "posted_at": "2026-10-10T13:12:32.000Z",
        "author_url": "https://www.reddit.com/user/lucidwray/"
      }
    ],
    "evidence": [
      "[post] Amazon Q (2025): a coding extension shipped with an injected prompt telling the agent to wipe the user's machine and cloud resources."
    ],
    "virality": "medium",
    "post_date": "2026-10-10T08:50:31.000Z",
    "post_kind": "text",
    "post_text": "Genuine question, not just ragebait.\n\nFor anyone who missed it: Meta's Muse launched last month and it can send your emails, pay for things and run your smart home on your behalf. Half of dev twitter called it insane. The same people then give their coding agent write access to the prod database, the deploy pipeline and the company AWS account.\n\nSo: your data, your infra, your customers' money. All of it, one prompt away.\n\nLet's recap what agents with too much access have already done:\n\nReplit (2025): an agent deleted a company's production database during a code freeze, then said it \"panicked\".\n\nAmazon Q (2025): a coding extension shipped with an injected prompt telling the agent to wipe the user's machine and cloud resources.\n\nAnd every team has its own smaller version. Ours ran a migration against the wrong environment because the env var looked right.\n\nWhy are we okay with this for code but not for email? What does your agent actually have access to?",
    "sentiment": "negative",
    "subreddit": "ChatGPTCoding",
    "event_date": "2025",
    "post_flair": [
      "Discussion"
    ],
    "post_title": "Why would anyone give a coding agent the keys to prod?",
    "prominence": "aside",
    "source_url": "https://www.reddit.com/r/ChatGPTCoding/comments/1x2ae60/why_would_anyone_give_a_coding_agent_the_keys_to/",
    "entity_role": "subject",
    "post_author": "Few-Pilot7575",
    "upvote_ratio": 0.6,
    "mention_count": 36,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/ChatGPTCoding/",
    "total_upvotes": 4,
    "comments_total": 31,
    "total_comments": 28,
    "event_date_text": "2025",
    "post_author_url": "https://www.reddit.com/user/Few-Pilot7575/",
    "signal_category": "event",
    "comments_included": 20,
    "products_mentioned": [
      "Amazon Q"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/587614b0-b2cd-5aaa-a442-055afb55c6e7 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"amazon.com","limit":20}'