Amazon Q Developer extension confirmed to be bypassed by prompt injection, enabling remote code execution

Security researchers disclosed an indirect prompt injection vulnerability in the Amazon Q Developer VS Code extension, allowing attackers to execute arbitrary commands on the host without developer authorization. The extension has over 1 million downloads, and in its executeBash tool the find command is classified in the readonly category, which can bypass manual confirmation and use the -exec parameter to execute arbitrary system commands; the author demonstrated popping a calculator with a prompt injection in source code comments. The author further bypassed Claude 4's refusal to download with curl, using a base64 payload with spaces and a Python script to restore it, achieving dynamic download and execution of instructions from a remote server, and also demonstrated downloading a Sliver malicious binary and connecting the host to a C2.