Align your AI Tools against backdoors

A trusted agent tool can turn malicious in an ordinary update and then act with the agent's access.

Tools: the apps and add-ons it can use
Backdoors: hidden behavior waiting for a trigger

Ways it goes wrong

A backdoor is hidden behavior that waits for a trigger, such as being installed or used. In agent tools it can arrive in an ordinary update to something already trusted, then act with the agent's access¹²³.

2025
Amazon Q extension release
An attacker used an over-broad access token to slip malicious code into a release of Amazon's coding assistant extension; it shipped but failed to run because of a syntax error.
Source: aws.amazon.com/security/security-bulletins/AWS-2025-015
2025
The postmark-mcp package
A new version of an unofficial email tool for AI agents reportedly began sending a hidden copy of every message to an outside address.
Source: snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails
2025
The nx package attack
Malicious versions of a popular build tool ran developers' AI coding assistants with their permission checks off to search for secrets.
Source: www.wiz.io/blog/s1ngularity-supply-chain-attack

What people do about it

AWS revoked the token, removed the code and pulled the affected version¹. Snyk advises anyone who used the email tool to uninstall it, rotate credentials and check mail logs². Wiz advises revoking and reissuing every token and key the malware could reach³.

Pin versions and review updates
Installs a fixed, reviewed version of each tool and reads what changed before taking a new one.
Scope every token narrowly
Gives each build system and tool a token for one job, meant to make a stolen token harder to misuse.
Rotate secrets after a bad version
Removes the bad version and replaces every key and password it could have seen.

Where we touch it

No study of ours covers this pair yet.

Sources

AWS, security bulletin AWS-2025-015, “Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)”. https://aws.amazon.com/security/security-bulletins/AWS-2025-015/. Accessed 2026-10-14. ↩ ↩²
Liran Tal (Snyk), “Malicious MCP Server on npm postmark-mcp Harvests Emails”, 2025-09-25. https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/. Accessed 2026-10-14. ↩ ↩²
Wiz, “s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know”, 2025-08-27. https://www.wiz.io/blog/s1ngularity-supply-chain-attack. Accessed 2026-10-14. ↩ ↩²