Blog Published: Jul 6, 2026

Amazon Q's MCP Auto-Load Bug Made Cloned Repos a Cloud Credential Risk

Wiz showed that older Amazon Q for VS Code (AWS's AI coding assistant extension) language-server versions automatically loaded workspace MCP (Model Context Protocol, a way for AI assistants to connect to external tools) configuration without consent, letting a malicious repository define a command-backed MCP server that inherited the developer environment and exfiltrated AWS identity data. AWS fixed CVE-2026-12957 in language server 1.65.0 and later.

Command InjectionCredential TheftTool AuthorizationMCP SecurityAI Coding IDE
9 applicable AIDEFEND defenses
Source: Remote Code Execution in Amazon Q for VS Code 
Author: Maor Dokhanian
Original article: Jun 26, 2026

Threat Analysis

  • The attack starts at repository trust. A developer opens a malicious workspace that contains .amazonq/mcp.json, making project files part of the AI assistant control plane.
  • The vulnerable client auto-executed configuration. Amazon Q loaded MCP server definitions without a workspace-trust or user-consent gate, so a repo-controlled command could run locally.
  • The MCP process inherited sensitive developer context. The proof of concept ran AWS CLI identity discovery and sent the result to an attacker endpoint.
  • The risk is bigger than one command. Any local secret, cloud session, source checkout, or developer network path reachable from the assistant process becomes potential follow-on material.
  • The strongest fix is signed and consented configuration. Client configuration should be validated, signed, reviewed, and blocked when it attempts shell startup or sensitive environment inheritance.

Applicable AIDEFEND Defenses (9)

AID-H-021.001
Client-Side Configuration Enforcement
Very High
Client-side configuration enforcement is the main preventive control: local workspace MCP configuration must be schema-checked, policy-checked, and blocked when it attempts dangerous startup behavior.
AID-H-021.002
Runtime Integrity Enforcement (Signed Configurations)
Very High
Signed configuration runtime enforcement directly addresses auto-load risk by rejecting unsigned, local, or drifted assistant configuration before the client starts tools.
AID-H-034.001
MCP Server Deployment Profile, Transport & Exposure Baseline
High
MCP server deployment baselines require protocol-pure stdio startup, minimal environment inheritance, and no shell-mediated launch path for workspace-supplied MCP servers.
AID-H-018.003
High-Impact Independent Validation & Approval Gate
High
A high-impact validator should require explicit approval before a repository can add a tool server that can execute commands or access cloud credentials.
AID-E-001.001
Root & Long-Lived Credential Object Eviction
High
If the malicious MCP command could read a developer's long-lived AWS access key, API key, client secret, or signing key, revoke or rotate that exact authoritative credential object. This is an incident-time eviction action, not routine client-side secret storage.
AID-I-001.004
Sandbox Network Egress Restrictions
High
Default-deny sandbox egress would stop a malicious MCP startup command from sending identity data to an attacker-controlled endpoint.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Inventory affected Amazon Q Developer client and language-server versions, deploy the fixed release through managed endpoint rings, and verify that no vulnerable build remains able to auto-execute repository-supplied MCP startup commands. This is the direct software-remediation owner.
AID-E-001.002
Issued Token, Authentication Session & Lease Revocation
High
If an already-issued AWS session token or other authentication session was reachable from the inherited developer environment, revoke that exact token and session population across every accepting service. Disabling a workload principal is a different owner and is not implied by session eviction.
AID-H-025.001
Pre-Execution Static Analysis & Dangerous Construct Blocking
Medium
Dangerous construct detection can flag MCP configurations that invoke shells, curl, AWS CLI, token reads, or other command patterns before the assistant starts them.

What Defenders Should Do Now

  • Upgrade Amazon Q Developer for VS Code to a version that includes language server 1.65.0 or later.
  • Search workspaces for .amazonq/mcp.json and review any command-backed or shell-backed MCP server definitions.
  • Block assistant clients from auto-loading unsigned workspace configuration and require explicit approval for new MCP servers.
  • Run AI coding tools with minimal environment variables, no long-lived AWS keys, and outbound egress controls.
  • Rotate cloud credentials for developers who opened untrusted repositories while running affected Amazon Q versions.

Conclusion

This case is a clean example of why AI coding assistants need client-side control-plane security. A repository is not just source code when the assistant reads it as configuration. Signed config, explicit consent, minimal environments, and egress policy turn a cloned repo back into a file tree instead of a code-execution decision.