The Hidden Contract: Your AI Assistant Is Running Your Repo’s Code
AI coding assistants increasingly read and execute commands from hidden project configuration files inside Git repositories, which means a single malicious config file can silently turn a trusted workspace into an attacker-controlled process that runs arbitrary code with access to developer credentials and cloud environments. Today’s productivity helpers have a dangerous secret: they act on whatever the repo tells them to do, often before the human understands what they have agreed to. The Amazon Q security flaw makes this painfully clear. A high-severity bug in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. Tracked as CVE-2026-12957 with a CVSS score of 8.5, the bug sat in how the AI coding assistant handled Model Context Protocol (MCP) servers. Opening the wrong Git repository could allow an attacker to execute code on a developer's machine and potentially hand them the keys to the cloud environment. That is not a niche edge case; it is a new class of AI coding assistant vulnerability.
Inside CVE-2026-12957: From Git Clone to Cloud Compromise
The attack path for CVE-2026-12957 is shockingly short. Wiz Research showed that a single config file dropped in a repo was enough to go from git clone to cloud compromise. Amazon Q looked for an `.amazonq/mcp.json` file in the open workspace, read the MCP configuration, and launched the servers it defined. MCP servers are local processes the assistant can spawn to reach databases, APIs, or build tools, so starting one means running commands on the machine. Those processes inherited the developer's full environment—AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets. Put the two together, and a file sitting in a cloned repo could run arbitrary code with the developer's live cloud session attached. According to Wiz, “a single malicious config file could execute arbitrary commands with full access to the developer's credentials – no user interaction required beyond opening the folder and activating Amazon Q”. Their proof of concept used the file to run `aws sts get-caller-identity` and ship the output to an attacker, capturing the active AWS session.
This Is a Supply Chain Attack Vector, Not a One-Off Bug
It is tempting to treat CVE-2026-12957 as an isolated Amazon Q security flaw, but the pattern is broader and more worrying. The flaw lives in Language Servers for AWS, the runtime that powers Amazon Q across VS Code, JetBrains, Eclipse, and Visual Studio; all four plugins bundle it, so all four were exposed by versions that shipped an older copy. The extension would automatically load a repository's `.amazonq/mcp.json` file and execute the commands it contained when a developer opened the project and activated Amazon Q. The security model assumed the user explicitly configures these servers, yet the implementation violated that assumption with no prompt, no consent, and no workspace trust check. More and more AI coding assistants are adopting MCP to connect models to local tools and services, allowing them to execute commands on developers' machines. Claude Code (CVE-2025-59536) and Cursor (CVE-2025-54136) both had project-level MCP config that led to command execution, while Windsurf (CVE-2026-30615) reached the same outcome by letting attacker-controlled content rewrite the local MCP config. Wiz argues the bug is less an Amazon problem than an industry one. In other words, the convenience of letting a project folder configure an AI agent is also the attack surface: repo-carried config is untrusted input, and turning it into a running process should take an explicit yes.
Who Was at Risk and What Has Been Fixed
The affected component was Language Servers for AWS, which powers Amazon Q across multiple IDEs. All four plugins—VS Code, JetBrains, Eclipse, and Visual Studio—were exposed by versions bundling the vulnerable language server. Amazon fixed the bug in version 1.65.0 of its language server, which powers Amazon Q's IDE integrations. CVE-2026-12957 is fixed in Language Servers for AWS 1.65.0, but Amazon's bulletin tells customers to move to 1.69.0. There is no known public exploitation; CISA's ADP entry for CVE-2026-12957 lists it as none. The patched plugin minimums are clear: VS Code 2.20 or later, JetBrains 4.3 or later, Eclipse 2.7.4 or later, and the Visual Studio toolkit 1.94.0.0 or later. Amazon has patched the flaw, and the language server auto-updates unless the network blocks it, with a reload of the IDE pulling the latest build. Wiz found the flaw through research and disclosed it in coordination with Amazon, reporting it on April 20 and seeing a fix on May 12, ahead of the June 26 public write-up. The timeline shows responsible response, but the underlying code execution risk remains a systemic concern.
Booby-Trapped Repos and the Future of AI-Assisted Development
The most unsettling takeaway is how little a developer has to do to fall into this trap. Opening the wrong Git repository could allow an attacker to execute code on a developer's machine and potentially hand them the keys to the cloud environment. Wiz Research showed that a single config file dropped in a repo was enough to go from git clone to cloud compromise. It suggests attackers have found a new place to lurk: the hidden files that developers rarely think twice about trusting. Those booby-trapped Git repos are now a credible supply chain attack vector, aimed squarely at the AI tools meant to boost productivity. This is a turning point. AI coding assistants have moved from helpful editors to semi-autonomous agents with authority to start processes and touch secrets. The convenience that makes them powerful also makes them dangerous. Until every assistant treats repo-carried configuration as hostile by default and demands explicit, informed consent for code execution, enterprises should treat these tools as part of their attack surface, not as neutral productivity software.
