A high-severity flaw in Amazon Q Developer enabled a malicious repository to execute arbitrary commands and exfiltrate a developer's cloud credentials. The attack vector was straightforward: a developer opening and trusting the workspace triggered the exploit, with Amazon Q handling the rest.
Tracked as CVE-2026-12957 with a CVSS score of 8.5, the vulnerability resided in how the AI coding assistant processed Model Context Protocol (MCP) servers. Researchers at Wiz discovered the flaw, which could lead to credential theft without requiring any additional user interaction beyond workspace trust.
The exploit mechanism leveraged MCP configurations to execute remote commands. No indicators of compromise were specified, but the attack could be initiated simply by a developer opening a malicious repository. This makes the flaw particularly dangerous in collaborative development environments where third-party code is common.
Amazon has released a patch for the vulnerability and published an advisory to inform customers about the potential impact. Users are urged to update their Amazon Q Developer installations immediately and to exercise caution when trusting workspaces from unfamiliar repositories.
No attribution to a specific threat actor was provided, but the flaw underscores the growing attack surface introduced by AI-assisted coding tools that operate with high levels of system access.