Amazon Q Handed Attackers a Credentialed API Call
What the Repos Actually Show
That framing is too generous to the defenders. The technique is prompt injection embedded in README files and repository metadata: the agent reads the instruction as context, interprets it as a legitimate task, and executes. Prompt injection means an attacker hides a command inside content the tool is expected to read, so the tool obeys the attacker instead of the developer. There is no CVE here. The attack surface is the agent's design assumption that content it is asked to read is content, not instruction. Amazon Q Developer's flaw, where a malicious repository could redirect the agent into exfiltrating developer cloud credentials, is the same class of problem from a different angle. Amazon Q authenticates to AWS on the developer's behalf; the malicious repo tells it what to do with that authentication. The logs, where they exist at all, show a credentialed API call from a known tool. That is not what your SIEM was tuned to flag. A security team that has not explicitly instrumented for this gap should assume it cannot see it. The detection rule that would catch it does not exist in the default rulesets of CrowdStrike Falcon, Splunk ES, or Microsoft Sentinel as shipped.
The FSI Exposure Nobody Priced
HKMA's Supervisory Policy Manual TM-E-1 and MAS TRM 2021 both address third-party and supply-chain risk in the context of vendors and service providers. Neither framework anticipated the agent pattern: a developer tool that authenticates to production cloud infrastructure, reads arbitrary external content as part of its normal workflow, and executes code on the developer's workstation with the developer's credential scope. The current frameworks were not written for this model and do not cover it adequately. What that means in practice: an FSI that has deployed GitHub Copilot, Amazon Q, or a comparable tool to its engineering team has extended its credential perimeter to every repository those agents touch, including repositories it does not own or control. Any CISO in this region operating under TM-E-1 or TRM 2021 now faces a specific decision: declare AI coding agents as third-party integrations under the existing supply-chain review process, or wait for guidance that has not been drafted. The Polymarket supply-chain attack, which cost customers approximately three million US dollars via a compromised analytics vendor, is the same shape, third-party code running in a trusted context, but with a human in the loop. The FSI sector in this region has not classified AI coding agents as third-party integrations under TM-E-1 or TRM 2021, and neither the HKMA nor MAS has issued guidance requiring it.
The North Korea macOS malware item and the poisoned-repo story are different techniques. In one, the attacker instructs the AI tool; in the other, the attacker deceives it. Both cases resolve the same way: the tool executes on behalf of the attacker using credentials the developer provided. Amazon Q's authentication to AWS is the instrument. The repository is the instruction source. The developer's workstation is where it runs. MAS TRM 2021 Section 9 names the vendor; it does not name the repository the vendor's tool reads.