Disclosed vulnerability
Amazon Q Developer for VS Code auto-loaded workspace MCP configs, giving repo-triggered code execution
AIR-2026-0143 AIR record · 2026-06-wiz-amazon-q-mcp-autoload
From the supporting source
Amazon Q automatically loaded MCP server configurations from .amazonq/mcp.json within the workspace-no prompt, no consent, no workspace trust check.wiz.io
The record
Disclosed
2026-06-26
Vendor
Amazon Web Services
Product
Amazon Q Developer Extension for VS Code (language server < 1.65.0)
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Privilege escalation
System type
Generative model
Who acted
Agent acted — Amazon Q auto-loaded the workspace MCP config and spawned processes
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious repository workspace config
Impact type
Remote code execution, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Developers opening an untrusted repository containing .amazonq/mcp.json
Capability abused
Defense & remediation
Recorded defense
VS Code workspace trust (not consulted)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Language server 1.65.0 adds a consent prompt before loading workspace MCP servers
Taxonomy & references
Curator notes
Author Maor Dokhanian (Wiz Research). Quote's em-dash normalized to a hyphen. Spawned processes inherit the developer's full environment including AWS credentials.
Supporting sources
Cite as
Enkrypt AI. "Amazon Q Developer for VS Code auto-loaded workspace MCP configs, giving repo-triggered code execution". AIR, AIR-2026-0143. https://agentincident.vercel.app/i/AIR-2026-0143/ (accessed 2026-10-19).