Coding Assistants
Amazon Q Developer
High riskAWS's AI coding assistant and agent for IDEs, the CLI, and the AWS console, with completions, chat, and code transformation tied into AWS accounts.
Is Amazon Q Developer safe for confidential data?
Amazon Q Developer carries two distinct risks. Data handling is tier-split: the Free tier may use your questions, code, and generated responses for service improvement including model training unless you opt out in IDE settings, while the Pro tier is excluded automatically — so unmanaged free-tier use is where company code leaks into AWS's improvement pipeline. Supply-chain integrity is the documented incident: in July 2025 an attacker used an over-scoped GitHub token to merge a malicious data-wiping prompt into the official VS Code extension, which AWS shipped to users as v1.84.0; the payload failed on a syntax error, and AWS pulled it and shipped a clean v1.85.0. Further prompt-injection and RCE flaws were patched quietly in August 2025. The service itself is a mature AWS product with strong enterprise controls — the calibration point is that the incident happened in the official distribution channel.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Content may be used for service improvement including model training by default; opt-out is a per-user IDE setting, not an organizational control.
Content excluded from service improvement automatically; adds IAM Identity Center integration, admin management, and higher limits under the organization's AWS agreement.
Data handling
Training on inputs
Free tier: questions, responses, and generated code may be used for service improvement, including model training, unless the user opts out in IDE settings (or via an AWS Organizations AI services opt-out policy for console use). Pro tier: content is not used for service improvement.
Retention
Handled under AWS service terms and the AWS data privacy framework; Pro-tier content is excluded from improvement pipelines. Confirm retention specifics for cross-region inference in your AWS agreement.
Residency
Runs on AWS infrastructure; processing regions depend on service configuration and may involve cross-region inference. Canadian organizations should verify whether processing can be constrained to ca-central-1 for PIPEDA or Quebec Law 25 purposes rather than assume it.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAAConditional
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- IAM Identity Center / SSO integration
- AWS Organizations policy controls
- Admin subscription management
- AWS DPA and service terms coverage
- CloudTrail-based audit visibility
Frequently asked questions
What happened in the Amazon Q extension hack?
In July 2025 an attacker exploited an inappropriately scoped GitHub token in the aws-toolkit-vscode build pipeline to merge a malicious prompt instructing the agent to wipe the local system and cloud resources. AWS unknowingly published it as VS Code extension v1.84.0 on July 17; researchers flagged it July 23, and AWS revoked credentials, pulled the version, and shipped clean v1.85.0. AWS says the payload failed to execute due to a syntax error. The Register later reported additional prompt-injection and RCE flaws patched quietly in August 2025. The takeaway is to pin and review extension updates for agentic tools, not just trust the marketplace channel.
How do we opt out of Amazon Q Developer data collection?
On the Free tier, each developer must disable content sharing in their IDE telemetry settings — there is no org-wide switch at that tier — and console usage is governed by an AI services opt-out policy in AWS Organizations. The cleaner fix is Pro: paid-tier content is excluded from service improvement automatically.
Developers installed the free tier with personal AWS Builder IDs. Does our AWS agreement cover that?
No — free-tier use under a personal Builder ID sits outside your organization's AWS agreement, with default data-sharing on and no admin visibility. Inventory who is running the extension, move real users onto Pro under IAM Identity Center, and treat the free tier like any other unsanctioned AI endpoint: monitored, or blocked.
Policy changelog
- Initial entry published from AWS's published security documentation and cited coverage.
Sources
- AWS security bulletin AWS-2025-015 (extension v1.84.0)
- BleepingComputer: Amazon AI coding agent hacked
- AWS docs: Amazon Q Developer service improvement
- The Register: Q Developer flaws quietly fixed
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Amazon Q Developer is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Browser-based AI app builder from StackBlitz that generates, runs, and deploys full-stack JavaScript applications from prompts, popular with founders and rapid prototypers.
AI-first code editor that sends repository context to hosted models for completions, chat, and multi-file agentic edits.
Autonomous AI software engineer that plans and executes multi-step development work with its own shell, browser, and repository access, sold to teams and enterprises.
AI pair programmer integrated into editors and the GitHub platform, offering code completion, chat, and agentic coding workflows.