Cloud Security

Amazon Q MCP Flaw: Open a Repo, Lose Your Cloud Credentials

June 27, 2026 · 6 min read · By CloudAI Security

Wiz researchers disclosed CVE-2026-12957 and CVE-2026-12958 in Amazon Q Developer on June 26, 2026, revealing that the AI coding assistant auto-executed Model Context Protocol (MCP) servers from repository files without user consent. A developer simply opening a malicious Git repo could surrender AWS credentials, API keys, and SSH sockets to an attacker within seconds of activation — a systemic trust-boundary failure now repeated across Claude Code, Cursor, and Windsurf.

How the MCP Auto-Execution Worked

The flaw sat in how Amazon Q’s VS Code extension handled MCP, the standard that lets AI assistants spawn local processes to call APIs, query databases, and run build tools. The secure model assumes a human explicitly configures each MCP server, because granting an AI permission to run arbitrary commands should require informed consent. Amazon Q violated that assumption: on folder open it read and executed any .amazonq/mcp.json sitting in the workspace root — no prompt, no consent dialog, no VS Code workspace trust check, per The Register’s coverage.

The decisive amplifier was environment inheritance. Each spawned MCP server inherited the developer’s full shell environment, so attacker code immediately touched AWS access keys, session tokens, API keys, and SSH agent sockets already loaded into the session. Wiz proved the chain end-to-end: a single bash command ran aws sts get-caller-identity against the victim’s live credentials and exfiltrated the result to an attacker-controlled host, all silently.

The Real Cloud Blast Radius

This was not a local nuisance bug. Once an attacker runs code with a developer’s AWS session, the cloud blast radius is large and fast. The documented escalation paths include stealing long-lived access keys, minting backdoor IAM users, planting infrastructure persistence, and pivoting through inherited VPN or bastion network context into production systems.

The second CVE, CVE-2026-12958, addressed missing symlink validation, which widened the file-loading primitive — a classic defense-in-depth failure where two low-severity components (trust boundary + path validation) combine into a high-severity outcome. CVSS 4.0 scoring landed CVE-2026-12957 at 8.5, reflecting low attack complexity, no privileges required, and minimal user interaction.

Not Just Amazon: An Industry Pattern

The most important takeaway is that Amazon Q is the symptom, not the disease. MCP auto-execution from workspace files is a recurring flaw class across AI coding tools, and the disclosure cadence is accelerating — the same trust-boundary theme we examined in the Anthropic Claude Skills framework and the LiteLLM RCE chain that turned AI keys into the prize. Wiz catalogued the related findings:

CVE	Product	Researcher
CVE-2025-59536	Claude Code	Check Point Research
CVE-2026-21852	Claude Code	Check Point Research
CVE-2025-54136	Cursor	Check Point Research
CVE-2026-30615	Windsurf	OX Security
CVE-2021-26700	VS Code NPM extension	Slack
CVE-2020-17023	VS Code Core	Justin Steven

Independent findings from OX Security and Check Point landed in the same window, which is not coincidence. Every vendor shipping an MCP-capable assistant made the same product decision: prioritize zero-friction onboarding over explicit consent for code execution. The convenience-vs-security trade-off was decided in favor of frictionless UX, and attackers now have a uniform, reusable primitive. This positions MCP workspace files as the new .env and .git/hooks — attacker-controlled input that defenders routinely forget to treat as hostile. If your AI tool reads a workspace file and runs it, you own this bug class until you change the default.

Delivery Vectors Attackers Prefer

The exploitation bar is low because the delivery vectors are already proven. Wiz and GBHackers flagged four realistic paths: typosquatted packages that developers mistype and clone, malicious pull requests merged into popular open-source projects, compromised dependencies that quietly add a .amazonq/ folder — the same repo-hopping vector behind the Miasma supply chain worm that swallowed 73 Microsoft repos — and fake job-interview coding tests, a documented DPRK tradecraft vector where a “candidate” is asked to clone and run a take-home project.

The last is the highest-risk scenario for cloud teams. A single engineer evaluating a repo during hiring, or a contractor pulling a vendor’s sample app, can hand an attacker an authenticated foothold into a production AWS account. There is no phishing, no exploit payload, and no AV signature — just a config file and a tool your developers already trust. Detection by EDR is unlikely because the process tree looks like legitimate IDE activity.

What Security Teams Must Do Now

Amazon shipped the fix quickly. The first language server patch landed in version 1.65.0 on May 12, 2026, and the full advisory lists Language Servers for AWS 1.69.0, Amazon Q Developer for VS Code 2.20, JetBrains 4.3, Eclipse 2.7.4, and AWS Toolkit 1.94.0.0 as patched. The AWS language server auto-updates in most configurations, so a forced IDE reload usually applies it — but do not assume. Treat this as an active scan, not a broadcast email.

Inventory and patch. Enumerate every developer endpoint and CI runner running Amazon Q or any MCP-capable assistant. Confirm the language server and plugin versions are above the advisory thresholds. Auto-update is not a control; verification is.
Hunt for prior exposure. Search developer machines and repos for unexpected .amazonq/, .cursor/, .claude/, or .windsurf/ directories. Review CloudTrail for anomalous sts:GetCallerIdentity calls or new IAM principals created from developer workstations since mid-April 2026.
Force workspace trust. Require VS Code workspace trust in restricted mode for untrusted folders across all developer images. Block auto-execution of any workspace config in managed policy.
Scorch inherited credentials. Rotate any long-lived AWS keys and review active sessions for developers who cloned third-party repos between April 17 and June 26, 2026. Prefer short-lived, scoped credentials and SSM-based access that do not sit in a shell environment.
Push the vendor bar. File this as a procurement requirement: any AI coding assistant your teams adopt must default-deny MCP auto-execution and integrate with workspace trust. No consent prompt, no purchase.

Why Workspace Trust Keeps Failing

The deeper lesson is governance, not patching. The same trust-boundary failure has recurred for six years across NPM extensions, VS Code core, Cursor, Claude Code, Windsurf, and now Amazon Q. Each time the vendor calls it fixed; the class survives. That persistence signals an industry gap: there is no standard, auditable contract for “this tool will not execute attacker-controlled files without consent.” Until procurement, AppSec, and developer-platform teams harden that contract into policy, the next CVE in this table is already written — it just has not been disclosed yet.

Treat AI coding assistants as part of your trusted computing base, with the same scrutiny applied to browsers and operating systems. If your threat model does not yet include “developer opens repo, cloud account falls,” it is out of date as of June 26, 2026.