Amazon Q Developer flaw enables cloud credential theft

A significant security vulnerability in Amazon's AI-powered coding assistant, Amazon Q Developer, allowed attackers to steal developers' cloud credentials simply by tricking them into opening a malicious code repository. The flaw, discovered by security researchers at Wiz and tracked as CVE-2026-12957, was publicly disclosed on June 26, 2026, after Amazon released patches in May.

The vulnerability resided in how the Amazon Q Developer extension for integrated development environments (IDEs) like Visual Studio Code handled Model Context Protocol (MCP) configuration files. MCP is a protocol that allows AI coding assistants to connect with external tools and data sources. The flaw allowed a malicious .amazonqmcp.json file placed within a code repository to be automatically loaded and executed without any user consent or warning when a developer opened that repository.

This automatic execution meant attacker-controlled commands could run silently in the background, inheriting the developer's full set of environment variables. For developers authenticated to Amazon Web Services (AWS) or other cloud platforms, this typically included sensitive access keys, session tokens, and region...