The IT Nerd

Researchers have uncovered a high-severity vulnerability in Amazon Q Developer Extension for Visual Studio Code (VS Code), which allowed attackers to achieve arbitrary code execution and cloud credential theft by having a developer open a malicious repository. Amazon Q automatically loaded MCP server configurations from workspace files without user consent. Combined with full environment inheritance, this enabled immediate code execution.  

Rohit Valia, CEO of cybersecurity company Tumeryk, provided the following comments: 

“The Amazon Q vulnerability shows us why AI coding assistants are now a legitimate attack surface. Organizations need to treat every AI tool with environment access as a potential credential exfiltration path. They need to ensure there are AI guardrails to block access for every AI tool use unless it is an approved action with real-time Risk Scoring of the prompts and responses for continuous observability.”

AI is all over the place. Most notably it is used by developers to develop code. This needs to get a whole lot safer whether by design, forced up by the companies, or government themselves.

Amazon Canada and the National Hockey League Players’ Association (NHLPA) today announced an expansion of their ongoing partnership, with Amazon committing more than $1 million CAD to local community organizations in 32 North American cities during the 2026–2027 hockey season.

The partnership reflects Amazon’s broader commitment to supporting the communities it serves, and where its employees live and work. Since launching in 2024, the partnership with the NHLPA has focused on delivering local impact by working closely with players and community organizations across Canada and, more recently, the United States.

As the first event of the expanded partnership, Amazon and the NHLPA are kicking off in Ottawa, where three local organizations with connections to NHLPA Goals & Dreams will each receive a $25,000 CAD donation to support their work making hockey more accessible and inclusive: Ottawa Power Wheelchair Hockey League, Canadian Blind Hockey Association, and Next Shift Canada.

Through the 2025–2026 NHL season, the partnership delivered more than $60,000 CAD in donations in Canada and more than $230,000 USD in the U.S., with organizations already seeing the impact–from expanding facilities to increasing access to critical community programs.

As part of the expanded partnership, NHL players will visit Amazon facilities in all 32 cities throughout the 2026–2027 NHL season, connecting with employees and presenting donations to local organizations making a meaningful impact in their communities.

Today, Amazon Web Services announced its first-ever quantum computing chip, Ocelot, that it claims can reduce the costs of implementing quantum error correction by up to 90%, compared to current approaches. More details can be found here:

 https://www.aboutamazon.com/news/aws/quantum-computing-aws-ocelot-chip

Dr. Marc Manzano, general manager of cybersecurity at Alphabet spinoff SandboxAQ, commented:

“Amazon’s Ocelot is yet another proof point that the quantum computing era is approaching. While we may be years away from a quantum computer powerful enough to break current encryption, advancements like this should serve as a clear call to action.

Organizations and information security teams without a concrete plan to migrate to quantum-safe cryptography are playing a dangerous waiting game. Every development in quantum computing brings us closer to the day when today’s secure communications become vulnerable, and proactive planning is essential to mitigate this looming threat.” 

It’s time to rethink any security that relies on being quantum computing resistant. Because the days of banking on that are clearly over.

This is a follow up to this recent story involving Amazon and workers rights. 

Investors of Amazon.com continued to lend their support to a shareholder proposal on freedom of association and collective bargaining during the company’s recent annual general meeting (AGM).  

The proposal, put forward by an international coalition of responsible investors representing 3.5-trillion USD in assets under management (AUM), called for Amazon to undergo a third-party assessment reviewing the extent to which it has been living up to its promises to respect international labour standards. 

According to Company filings that were published on Friday, approximately 32 per cent of votes were cast in favour of the proposal — the second-highest level of investor support for any of the 14 shareholder proposals voted on at last Wednesday’s AGM. Accounting for the large number of shares controlled by board member and former Amazon CEO Jeff Bezos, roughly 37 per cent of independent votes were cast in favour of the proposal. 

This vote comes amid a number of recent concerning developments in Amazon’s relationship with its workers. A major British trade union, GMB, recently announced legal action against the Company in the U.K. over allegations of anti-union practices; in the U.S., a federal administrative judge ruled that CEO Andy Jassy violated federal law by making comments on unions. 

These developments coincided with a surge in investor support for the shareholder proposal. In addition to the original coalition of 22 cofilers, the proposal was publicly supported in recent weeks by numerous major public funds and asset managers: 

• the California Public Employees’ Retirement System (CalPERS) 
• the California State Teachers’ Retirement System (CalSTRS) 
• the Office of the New York City Comptroller  
• the New York State Common Retirement Fund 
• Norges Bank Investment Management (NBIM)  
• Legal and General Investment Management (LGIM). 

The proxy advisory firms International Shareholder Services (ISS) and Glass-Lewis also backed the proposal, despite management’s opposition. 

Sarah Couturier-Tanoh, Director of Shareholder Advocacy for SHARE, the Shareholder Association for Research and Education, which led the investor coalition behind the proposal had this comment: 

“Once again, shareholders have sent a clear message to Amazon’s board and management that the Company must do better in delivering on its commitment to workers’ rights,”

“Given the widespread support the proposal received, we expect the board to demonstrate — at a minimum — what it is doing to comply with international human rights standards and mitigate the labour-rights related risks shareholders are seeing.” 

Shareholders of Amazon.com, Inc. are urging the company to assess whether it has lived up to its own commitment to respect workers’ rights to freedom of association and collective bargaining. 

Amazon’s upcoming annual general meeting (AGM) on May 22 comes amid ongoing unionization efforts at the company – including recent applications in the U.S. and U.K. – and media reports alleging intimidation, retaliation, and surveillance.  In Canada, British Columbia and Quebec-based unions have recently filed applications to represent Amazon employees, following numerous concerns about working conditions at Amazon Canada’s facilities. 

To get to the bottom of these complaints, a group of more than 20 global investors led by SHARE, the Shareholder Association for Research and Education, has filed a shareholder proposal urging Amazon’s Board of Directors to assess how the company’s actions align with its own policies and obligations to respect international human rights law, including the Core Conventions of the International Labour Organization (ILO), the ILO Declaration on Fundamental Principles and Rights at Work. 

The investors maintain that effective and transparent due diligence on human rights and policy implementation is needed to reassure shareholders when allegations of misconduct arise. 

The proposal’s 22 co-filers represent approximately $US 3.5 trillion in assets under management (AUM) and include investors from across Europe and North America. Both major proxy advisory services, ISS and Glass Lewis, are now recommending voting for a shareholder proposal urging Amazon’s Board of Directors to assess how the company’s actions align with its own policies and obligations to respect international human rights law.

Sarah Couturier-Tanoh, Director, Shareholder Advocacy for SHARE had this to say:

“Beyond the ethical imperative to respect human rights, any failure to align workforce practices with internationally recognized human rights norms represents a threat to shareholder long-term value. That’s why, in the past couple of years, we have seen global investors taking stances in favor of better labor relations in an effort to mitigate those risks in their investment portfolio. In the past six months, several companies answered the call, including Starbucks and Apple. We are still waiting for Amazon to follow suit and, frankly, to do even better.” 

This will be interesting to see what happens, and if Amazon will fight this. Stay tuned.

On top of downsizing 18,000 of employees, it’s now making the news that 9000 more jobs are being slashed at Amazon:

Amazon will lay off 9,000 more employees in the coming weeks, CEO Andy Jassy said in a memo to staff on Monday.

The cuts are on top of the previously announced layoffsthat began in November and extended into January. That round totaled more than 18,000 employees, and primarily affected staffers in its retail, devices, recruiting and human resources groups.

Amazon made the decision to lay off more employees as it looks to streamline costs. It took into account the economy, as well as the “uncertainty that exists in the near future,” Jassy said. The company just wrapped up the second phase of its annual budgeting process, referred to internally as “OP2.”

“The overriding tenet of our annual planning this year was to be leaner while doing so in a way that enables us to still invest robustly in the key long-term customer experiences that we believe can meaningfully improve customers’ lives and Amazon as a whole,” Jassy said.

This also follows up Facebook/Meta doing a version of the same thing. Which doesn’t bode well for the tech sector as this may spur other companies to do the same thing. We’ll have to see what happens on that front, but I suspect that the next few weeks and months ahead will be very bumpy.

The ALPHV ransomware group has claimed responsibility for an attack on Amazon’s security camera company, Ring, and is threatening to leak their data. This came to light because of this Tweet:

ALPHV is known for using the BlackCat malware in their attacks. The ALPHV group operates a ransomware-as-a-service platform. The group also has a searchable database of its victims who deny paying the ransom on the site.

The fact that someone might have pwned Amazon is plausible. Last December Brian Krebs carried a story on two US teens that were busted for taking control of RING camera’s and then Swatting the home owners and recording the police raid. The RING system is just one more IoT device that is attractive, and apparently vulnerable, to malicious hackers.

David Maynor, Senior Director of Threat Intelligence, Cybrary had this comment:

   “The exploitation of IOT devices that consumers rely on continues to march towards every dystopian movie plot. Attackers have moved from ransoming devices to ransoming companies. These attacks continue to have an increasing impact on the daily life of users.”

We’ll know soon enough if this threat to leak data is real or not. If it is real, I assure you, any company who plays in this space will be freaking out. And so will their customers.

One of the reasons why I use Apple products is the fact that they appear to be privacy focused. I value my privacy and many others do. Which is why this report released last week that says that Amazon uses voice data from its Echo devices to serve targeted ads on its own platforms and the web:

The report, produced by researchers affiliated with the University of Washington, UC Davis, UC Irvine, and Northeastern University, said the ways Amazon does this is inconsistent with its privacy policies. Titled, “Your Echos are Heard: Tracking, Profiling, and Ad Targeting in the Amazon Smart Speaker Ecosystem,” the report concludes that Amazon and third parties (including advertising and tracking services) collect data from your interactions with Alexa through Echo smart speakers and share it with as many as 41 advertising partners. That data is then used to “infer user interests” and “serve targeted ads on-platform (Echo devices) as well as off-platform (web).” It also concludes that this type of data is in hot demand, leading to “30X higher ad bids from advertisers.” 

Amazon confirmed to The Verge that it does use voice data from Alexa interactions to inform relevant ads shown on Amazon or other sites where Amazon places ads. “Similar to what you’d experience if you made a purchase on Amazon.com or requested a song through Amazon Music, if you ask Alexa to order paper towels or to play a song on Amazon Music, the record of that purchase or song play may inform relevant ads shown on Amazon or other sites where Amazon places ads.” Amazon spokesperson Lauren Raemhild said in an email. 

The company also confirmed there are targeted ads on its smart speakers. “Customers may receive interest-based ads when they use ad-supported premium content — like music, radio or news streams,” said Raemhild, pointing out that this is the same experience if they engaged with that content on other channels. She went on to say that Amazon does not share voice recordings with developers. “Developers get the information necessary to fulfill your requests within their skills, such as answers when you play a trivia skill, or the name of the song you want to play,” she said. “We do not share our customers’ personal information to third-party skills without the customer’s consent.” Amazon allows Alexa users to opt out of ad targeting as well (see sidebar).

This isn’t news. Amazon is known to find new and creative ways to monetize data. And the fact that they admit to doing this and act like it’s no big deal illustrates that. The only way that this behaviour by Amazon will change is if consumers don’t buy Amazon smart speakers. Because all Amazon understands and cares about is money.