Amazon Q Developer (versions before the May 12 patch)

The extension trusted configuration files found in an open workspace without first confirming the user wanted to run what those files defined. Treating a file dropped into a folder as an instruction to execute, rather than as untrusted input to review, is the entire flaw.

An attacker plants a .amazonq/mcp.json file inside a public or shared repository. When a developer opens that repository in VS Code with Amazon Q Developer installed, the extension reads the file and launches the MCP server it defines — as a local process that inherits the developer's full environment, including AWS keys and other cloud credentials loaded in that session. From git clone to cloud compromise takes a single workspace open, no further clicks required.

1. Review any repository opened recently for an unexpected .amazonq/mcp.json file, especially one not committed by a known contributor.
2. Audit AWS CloudTrail logs for API calls made shortly after a developer's IDE session began, particularly from credentials tied to a workstation rather than a service role.
3. Check Amazon Q Developer's extension version against AWS's patched release — anything before May 12, 2026 is exposed.

1. Update the Amazon Q Developer extension to the patched version immediately.
2. Rotate any AWS credentials that were active in a VS Code session where an untrusted repository was opened.
3. Treat any repository-supplied configuration file as untrusted input — review it before opening the workspace in an editor with AI-assistant integrations enabled.