Amazon Q Extension Bug Lets Malicious Repos Execute Code and Harvest Credentials
A vulnerability (CVE-2026-12957, CVSS 8.5) in Amazon Q VS Code extension auto‑loads Model Context Protocol configs from workspace files, allowing code execution and credential theft when a developer opens a malicious repo. Amazon patched it in version 1.65.0, underscoring a systemic risk for AI‑powered coding tools that auto‑execute config files.