Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection
The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q Developer), which is a very popular coding agent, with over 1 million downloads. It is vulnerable to prompt injection from untrusted data and its security depends heavily on model behavior. At a high level Amazon Q Developer can leak sensitive information from a developer’s machine, e.g.
Summary from Embrace The Red.
Explained
The technology and terms in this story. Learn more
- ProtocolDNS · Domain Name SystemThe internet's phone book: it turns names like example.com into the addresses computers connect to.
- AttackPrompt injectionHiding instructions in content an AI reads, so it follows the attacker instead of its user.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
