Amazon Q Bug Let Hackers Steal Cloud Creds via Git Repos

The Flaw That Broke the Trust Model

Amazon Q's Visual Studio Code extension had a high-severity vulnerability (CVE-2026-12957, CVSS 8.5) that allowed attackers to execute arbitrary commands and steal cloud credentials simply by opening a booby-trapped Git repository. The bug, discovered by Wiz researchers, exploited the Model Context Protocol (MCP) integration: the extension automatically loaded and executed commands from a hidden .amazonq/mcp.json file without any user consent or workspace trust check. This is not a theoretical risk—Wiz built a working proof-of-concept that used the developer's own AWS credentials to run commands against their cloud environment. Amazon patched the issue in language server version 1.65.0, but the incident exposes a deeper structural problem in how AI coding assistants handle local execution.

Why This Matters for Your Bottom Line

For enterprises relying on Amazon Q or similar AI coding tools, this vulnerability represents a direct threat to cloud security. The attack vector is deceptively simple: a developer clones a public repository, opens it in VS Code, activates Amazon Q, and within seconds an attacker can exfiltrate AWS keys, API tokens, and SSH agent sockets. No phishing, no social engineering—just a malicious config file in a repo. The implications extend beyond Amazon Q: Wiz notes that similar workspace configuration flaws have surfaced in other AI coding assistants, suggesting a systemic weakness in the industry's adoption of MCP. For security teams, this means auditing not just Amazon Q but every AI tool that executes local commands based on project files.

Strategic Winners and Losers

Who Gains

Wiz has cemented its reputation as a top-tier cloud security researcher. By responsibly disclosing the flaw and publishing a detailed analysis, Wiz gains credibility and likely attracts more enterprise clients seeking to audit AI toolchains. Competing AI coding assistants—GitHub Copilot, Tabnine, Cursor—can now market their own security practices as superior, especially if they require explicit user consent for MCP configurations. Security vendors offering runtime protection for developer environments will see increased demand as companies scramble to lock down their CI/CD pipelines.

Who Loses

Amazon faces reputational damage and potential loss of developer trust. While the patch was swift, the fact that such a basic security assumption—user consent for local command execution—was violated raises questions about Amazon Q's design review process. Amazon Q users who were exposed before the patch may need to rotate credentials, audit cloud resources, and investigate potential breaches—a costly and time-consuming process. The broader AI coding assistant ecosystem now faces increased scrutiny from security teams, potentially slowing adoption as enterprises demand more rigorous security audits.

Market and Regulatory Impact

This incident will accelerate calls for mandatory security standards in AI-powered development tools. Regulators in the EU and US are already eyeing AI safety; a credential-theft vector in a widely used tool could trigger investigations. Expect the Cloud Security Alliance and OWASP to publish guidelines for MCP security, and for enterprises to mandate sandboxing or containerization of AI assistants. In the short term, Amazon Q's market share may stall as risk-averse organizations pause deployments. Long-term, the industry will likely shift toward a zero-trust model for AI tooling, where every command execution requires explicit approval and runs in an isolated environment.

Actionable Recommendations for Executives

• Immediately update Amazon Q to version 1.65.0 or later. Verify that automatic updates are enabled across all developer machines.
• Rotate all AWS credentials that may have been exposed since the vulnerability was introduced. Assume compromise if developers used Amazon Q with untrusted repositories.
• Audit all AI coding assistants in your organization for similar MCP or workspace configuration risks. Require explicit user consent for any local command execution.
• Implement runtime monitoring for developer environments to detect anomalous command execution or credential access.
• Review your supply chain security policy to include AI tooling as a critical risk vector. Treat cloned repositories as untrusted until proven safe.

Outlook: The Next 30 Days

Watch for proof-of-concept exploits to appear in the wild as attackers reverse-engineer the vulnerability. Expect Amazon to release additional security advisories for other AWS services that integrate with Amazon Q. Competitors will publish blog posts highlighting their own security features. Security researchers will likely uncover similar flaws in other AI coding assistants, triggering a wave of patches and CVEs. Enterprises should treat this as a catalyst for a broader security review of all AI-powered development tools.

Source: The Register