Amazon Q Developer flaw let cloned repos steal AWS keys
A recently patched vulnerability in Amazon’s AI coding assistant could have allowed attackers to silently steal enterprise cloud credentials simply by having a developer clone a compromised repository.
Amazon has patched a severe vulnerability in its Amazon Q Developer tool that automatically exposed a user's full AWS credentials the moment they cloned a malicious code repository. Discovered by Wiz Research and tracked as CVE-2026-12957, the flaw was reported to Amazon on April 20 and fixed by May 12.
The vulnerability exploited the Model Context Protocol, a system that allows AI assistants to connect to external tools. By placing a configuration file inside a repository, attackers could force the integrated development environment to silently register and launch a rogue server without any user consent. This server inherited the developer's AWS account ID, user ARN, session credentials, and other environment variables.
For enterprises relying on cloud infrastructure, this represents a critical blind spot in the software supply chain. A single developer cloning an open-source project could inadvertently hand an attacker the keys to production environments. Wiz researchers proved the concept by extracting credentials and sending them to an external server, demonstrating that the attack required zero interaction beyond the initial clone.
Amazon addressed the issue by requiring explicit user approval before launching these servers and restricting the environment variables they can access. The company also patched a related flaw, CVE-2026-12958, which exploited symbolic links to write arbitrary files anywhere on a developer's system. The fixes apply to updated Language Servers for AWS and plugins for VS Code, JetBrains, Eclipse, and Visual Studio.
This disclosure places Amazon Q Developer alongside Anthropic’s Claude Code, Cursor, and Codeium’s Windsurf as AI tools recently found vulnerable to supply chain attacks. The core problem is architectural: the protocol inherently inherits the permissions of the host application. When AI tools blindly trust repository contents, the attack surface expands from the codebase to every connected enterprise service.
Amazon stated there is no evidence the flaw was exploited in the wild, and CISA has logged no known attacks. However, corporate IT departments must treat the rapid adoption of AI coding assistants as a pressing security liability. Developers need to update their IDE plugins immediately and audit recently cloned repositories for suspicious configuration files.
