Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A critical security vulnerability recently discovered in Amazon's Q Developer tool highlights the potential risks embedded within AI-powered development environments. The flaw, now patched by Amazon, presented a severe threat that could allow attackers to execute arbitrary commands and exfiltrate sensitive cloud credentials through seemingly innocent development workflows. This discovery serves as a stark reminder of how security vulnerabilities can lurk within the tools developers trust most.

The vulnerability, tracked as CVE-2026-12957 with a CVSS score of 8.5, resided in how Amazon's AI coding assistant processed Model Context Protocol (MCP) servers. The attack chain was alarmingly straightforward: a developer would simply open a malicious repository, grant the necessary workspace trust permissions, and Amazon Q would handle the rest, inadvertently executing the attacker's commands. According to researchers at Wiz who identified the issue, this exploitation pathway could compromise developers' cloud credentials with minimal interaction, potentially providing attackers with unauthorized access to cloud infrastructure.

All users of Amazon Q Developer were potentially affected by this vulnerability, though the specific impact depended on their usage patterns and security practices. The issue matters particularly because AI coding