MCP Auto-Execution Flaws Enable Cloud Credential Theft

A high-severity vulnerability (CVE-2026-12957) was discovered in the Amazon Q Developer extension for Visual Studio Code, which allowed for immediate arbitrary code execution when a developer simply opened a malicious repository. The flaw stems from the extension's automatic loading of Model Context Protocol (MCP) server configurations from workspace files without user consent or workspace trust checks.

Technically, the vulnerability exploited the inheritance of the developer's full environment, including active AWS credentials, API keys, and SSH agent sockets. This risk is systemic across the AI coding tool ecosystem, with similar vulnerabilities independently identified in other popular tools like Claude Code, Cursor, and Windsurf.

This flaw poses a significant risk to cloud-native organizations, as it enables attackers to escalate from local repository interaction to full cloud environment compromise. Attack scenarios include social engineering via fake job interviews, malicious pull requests, and dependency typosquatting.