Amazon Q Flaw Let Malicious Repos Steal AWS Credentials

Wiz researchers have gone public with a flaw in Amazon Q Developer, the AI coding assistant that lives inside editors like VS Code and JetBrains, that managed to turn the very ordinary act of opening a repository into a credential heist.

The extension was reading configuration files bundled into a workspace and acting on them. No permission prompt. No warning. No fuss. Just quiet execution of whatever the repo author wanted to run, inside the developer's environment.

How the attack worked

A booby-trapped repo could spawn a shell the moment a developer opened it, inherit whatever happened to be sitting in their environment, and quietly walk off with active AWS session tokens or API keys. From there, the attacker has a foothold in the cloud account those credentials belong to, which in most engineering setups is not a small thing.

Wiz sketched out a few plausible ways someone might actually get a target to open such a repo:

• A fake coding test, of the sort North Korean operators have been using to lure engineers into running attacker-controlled code.
• A typosquatted open source package that looks like one a developer was already reaching for.
• A malicious pull request to a project the target already trusts and contributes to.

None of those require anything exotic. They all rely on the developer doing what developers do all day: cloning things and opening them in an IDE.

The fix

AWS was notified on 20 April and shipped a fix on 12 May, with a public advisory following this week. The issues are tracked as CVE-2026-12957 and a related symlink bug, CVE-2026-12958. Patches went out across the VS Code, JetBrains, Eclipse and Visual Studio plugins, along with the underlying language server at version 1.65.0.

The language server auto-updates in most environments, so for many developers the fix arrives without ceremony. Reloading the IDE is enough to pull it in. If you want to be sure, checking the installed plugin version is a thirty-second job worth doing.

It is not just Amazon

The more interesting thread Wiz pulled on is that this auto-execution pattern is not unique to Amazon Q. Similar behaviour has shown up in Claude, Cursor and VS Code itself, which suggests the wider category of AI coding tools is still working out where the line sits between helpful and far too eager.

The pitch for these assistants is that they reduce friction. They read your project, understand the context, and offer something useful before you've finished typing. The trade-off, which is only now becoming visible, is that reading your project can quietly mean running things from your project, and the threat model for that has not really caught up with how quickly these tools have been adopted.

What to do today

For developers using Amazon Q Developer, the practical moves are short. Check the plugin version. Reload the IDE so the patched language server is the one actually doing the work. Assume that any repository cloned in a hurry, particularly from an unfamiliar source, deserves a slightly more sceptical look than it did last month.

And for anyone using one of the other AI coding assistants, this is a useful nudge to read the docs on what your tool will execute on its own initiative. The answer is rarely nothing.