Amazon Q MCP Auto-Execution: Shell Spawned from VS Code Extension Host

Ethan Andrews@eandrews

•updated Jun 26, 2026•2•0•1

Detects the spawning of shells (bash, sh) or utility processes (npx) as child processes of Amazon Q or VS Code extension host components. This activity is indicative of exploitation attempts involving malicious Model Context Protocol (MCP) server configurations within workspace environments, as identified by CVE-2026-12957.