The New Security Gap in AI Coding Assistants
AI coding assistant security now faces a critical vulnerability class where project configuration files can silently trigger malicious code execution on a developer’s machine and expose cloud credentials when the assistant loads a repository and starts its helper processes without adequate consent or sandboxing, turning routine Git operations into a path for compromise. The latest Amazon Q vulnerability makes this threat impossible to ignore. A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. In practice, opening the wrong Git repository could allow an attacker to execute code on a developer's machine and potentially hand them the keys to the dev's cloud environment. That is not an edge case; it is a direct collision between convenience-driven AI tooling and basic security boundaries.
Inside CVE-2026-12957: From Clone to Cloud Compromise
CVE-2026-12957 shows how thin the line is between helpful automation and AWS credential theft. The bug sits in how Amazon Q handled Model Context Protocol (MCP) servers: it read an MCP configuration file, .amazonq/mcp.json, from the open workspace and launched the servers it defined. MCP lets AI assistants start local processes to reach databases, APIs, or build tools, so launching a server is effectively running commands on the developer’s machine. Those processes inherited the developer's full environment – AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets. Wiz Research showed that a single config file dropped in a repo was enough to go from git clone to cloud compromise, with a proof-of-concept that ran aws sts get-caller-identity and shipped the output to an attacker, capturing the active AWS session. Tracked as CVE-2026-12957 with a CVSS score of 8.5, this is not a theoretical risk.
This Is a Supply Chain Attack Surface, Not a One-Off Bug
The uncomfortable truth is that this Amazon Q vulnerability is a symptom of a broader design pattern in AI coding assistants, not an isolated mistake. When a single malicious config file can execute arbitrary commands with full access to the developer's credentials, opening a compromised or booby-trapped Git repository becomes a supply chain attack vector. Project configuration turns into executable behavior, and the trust checks around that handoff keep failing. Similar workspace configuration flaws have appeared in other tools: Claude Code and Cursor both had project-level MCP config that led to command execution, while Windsurf reached the same end by rewriting local MCP config to register a malicious server. More and more AI coding assistants are adopting MCP to connect models to local tools and services, allowing them to execute commands on developers' machines. According to Wiz, "the bug is less an Amazon problem than an industry one," highlighting how AI tooling integration can bypass traditional security boundaries.
Impact, Fixes, and Why the Risk Persists
Language Servers for AWS, the runtime that powers Amazon Q across VS Code, JetBrains, Eclipse, and Visual Studio, carried this flaw in versions that bundled the older copy. Amazon has patched it: CVE-2026-12957 is fixed in Language Servers for AWS 1.65.0, though the bulletin tells customers to move to 1.69.0. The patched plugin minimums are VS Code 2.20 or later, JetBrains 4.3 or later, Eclipse 2.7.4 or later, and Visual Studio toolkit 1.94.0.0 or later. The language server auto-updates unless the network blocks it, and reloading the IDE pulls the latest build. There is no known public exploitation; CISA's ADP entry for CVE-2026-12957 lists it as none. But that should not be a comfort blanket. The vulnerability allowed a file sitting in a cloned repo to run arbitrary code with the developer's live cloud session attached. What comes next depends on that developer's cloud permissions: backdoor an IAM user, reach internal services, or pivot toward production.
AI Tooling Must Respect Security Boundaries
The lesson from CVE-2026-12957 is blunt: repo-carried config is untrusted input, and turning it into a running process should take an explicit yes. Today’s AI coding assistants treat project folders as both context and control plane, and in doing so they open a powerful route for malicious code execution and supply chain attack scenarios. Attackers have found a new place to lurk: the hidden files that developers rarely think twice about trusting. Integrating AI deeply into development workflows without matching security design means these tools can quietly bypass the boundaries that separate code, environment, and credentials. The industry needs to accept that informed consent, sandboxing, and strict separation between project configuration and command execution are not optional features but safety requirements. Until AI coding assistants treat command execution with the same skepticism we apply to unknown binaries, every git clone risks becoming a doorway to AWS credential theft and cloud compromise.
