Wiz showed that older Amazon Q for VS Code language-server versions automatically loaded MCP server configuration found in an opened workspace, without a workspace-trust or user-consent gate. A malicious repository could therefore ship a .amazonq/mcp.json defining a command-backed MCP server, and simply opening the workspace caused the assistant to start that command locally. The spawned process inherited the developer's environment; Wiz's proof of concept ran AWS CLI identity discovery and sent the result to an attacker-controlled endpoint. Any local secret, cloud session, source checkout or reachable developer network path was available to the same process as follow-on material. AWS assigned CVE-2026-12957 and fixed the behaviour in language server 1.65.0 and later.
ASSESSED SYSTEM
Amazon Q Developer for VS Code running an affected language-server version (before 1.65.0) on a developer workstation, in the pre-fix configuration in which workspace-supplied .amazonq/mcp.json MCP server definitions were auto-loaded and started without a workspace-trust or user-consent gate, with the spawned MCP process inheriting the developer's environment including AWS credentials. Representative rather than named: the evidence is Wiz's demonstration against the shipping client plus AWS's CVE and fix, not a report from an identified victim organisation.
OUT OF SCOPE
Language server 1.65.0 and later (AWS's fix for CVE-2026-12957); Amazon Q's cloud service backend and the model itself; other Amazon Q clients and IDE integrations; the developer's AWS account-side controls (IAM policy, session duration, CloudTrail); and the attacker-controlled repository and endpoint.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 NO — a single assistant with tool servers; no second agent exchanging messages. Q2 YES — the assistant maintains task state across a coding session and invokes tools and connectors without explicit human approval for each action; in the affected versions it loaded and started MCP server definitions found in the workspace with no consent gate at all, so a repo-controlled command ran locally. Evidence artefacts: the .amazonq/mcp.json configuration surface, the auto-load behaviour AWS fixed in language server 1.65.0, the command-backed MCP server definition, and the spawned process's inherited environment. Tier 3: Tier 3 Internal — a code assistant running inside the organisational boundary for controlled users (developers), which is the spec's own Tier 3 example; the realised harm is developer-credential and source-code exposure to the employing organisation rather than immediate physical, financial or societal harm at scale.
Documented attack or failure path
- Attacker publishes a repository containing a .amazonq/mcp.json workspace configuration file that defines a command-backed MCP server.
- A developer clones and opens that workspace in VS Code while running an Amazon Q language server earlier than 1.65.0.
- The client auto-loads the workspace MCP configuration with no workspace-trust prompt and no user consent gate, treating repository content as assistant control-plane configuration.
- The defined command is launched locally as an MCP server process, inheriting the developer's environment variables, cloud session and filesystem access.
- The proof-of-concept command runs AWS CLI identity discovery and transmits the result to an attacker-controlled endpoint.
- Any long-lived AWS access key, issued session token, local secret, source checkout or reachable internal network path in that environment becomes available for follow-on use.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- AWS assigned CVE-2026-12957 and shipped a fix in language server 1.65.0, giving operators a precise affected/fixed version boundary to reconcile endpoint fleets against.
- The demonstrated chain stayed at the developer's existing privilege level — no privilege escalation to root or administrator was reported, so the blast radius is bounded by what that developer account already held.
- The path is not remotely triggerable: it requires the developer to open an attacker-supplied workspace, which preserves a human action as the entry condition and makes 'repositories opened while running affected versions' a tractable incident scope.
- The finding was disclosed and remediated through coordinated vendor channels rather than surfacing as in-the-wild exploitation.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.75 (midpoint 0.38), Tier 3 MVT 0.40 indeterminate | |||
| Ro-4Poisoning Attack Resistance | 0.00w 0.25 | Ro-4 0.00: no tool-metadata integrity validation on the ingestion path; poisoned sources are accepted without scanning, provenance checks or quarantine. | A tool-server definition supplied by untrusted repository content was accepted and executed with no provenance check, no signature requirement, no policy check and no quarantine. The brief's two Very High controls (AID-H-021.001 client-side configuration enforcement, AID-H-021.002 signed-configuration runtime enforcement) are both stated as missing: configuration 'must be schema-checked, policy-checked, and blocked when it attempts dangerous startup behavior', and unsigned local configuration must be rejected 'before the client starts tools'.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 3 MVT 0.45 indeterminate | |||
| Tr-4Model Lineage Disclosure | 0.25w 0.20 | Tr-4 0.25: limited lineage artefacts exist for the base component only; tool-manifest and configuration lineage is incomplete — here, absent by construction for the workspace-supplied servers. | Component lineage for the client is publicly documented and actionable — CVE-2026-12957, affected language-server versions, fixed version 1.65.0 — which is what lets defenders 'inventory affected Amazon Q Developer client and language-server versions'. Against that, the incident is precisely a tool-manifest lineage failure: MCP servers entered the running configuration from repository content with no recorded origin, owner or review, and no model, prompt or tool-inventory lineage for the assessed deployment is available.source: vendor |
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 3 MVT 0.50 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | Pr-3 0.25: minimisation controls do not cover this path; an unnecessary propagation path exposes sensitive credential material to a subprocess whose purpose does not require it. No evidence is available about minimisation on the assistant's primary prompt and telemetry paths, so the higher 0.50 anchor is not claimed. | The MCP process inherited the developer's sensitive context wholesale. The remediation is to require 'minimal environment inheritance' (AID-H-034.001) and to 'run AI coding tools with minimal environment variables, no long-lived AWS keys', confirming that the assessed configuration passed the full environment — including cloud credentials — to a workspace-defined subprocess that had no documented need for it.source: brief |
| Containment (Cn) — scenario interval 0.00–0.46 (midpoint 0.23), Tier 3 MVT 0.50 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | Cn-1 0.00: no effective scope boundary — untrusted workspace content reached tool, filesystem, credential and network resources it was never authorised to reach. | Opening a workspace made project files part of the assistant control plane: the client loaded MCP server definitions 'without a workspace-trust or user-consent gate, so a repo-controlled command could run locally', and the resulting process could reach local secrets, the cloud session, source checkouts and developer network paths. No boundary distinguished repository data from client configuration.source: brief |
| Cn-2Escalation Prevention | 0.00w 0.16 | Cn-2 0.00: no escalation controls on this path — untrusted input invokes restricted tooling and bypasses (absent) approval workflows. Scored for the MCP auto-load path specifically; per-tool approval behaviour elsewhere in the product is not evidenced either way in this brief. | There was no approval workflow to bypass: the affected client auto-executed repository-supplied configuration, so untrusted content obtained the ability to invoke an arbitrary local command with the assistant's full privileges. The brief's AID-H-018.003 recommendation — 'a high-impact validator should require explicit approval before a repository can add a tool server that can execute commands or access cloud credentials' — describes a control that did not exist.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.14 | Cn-5 0.00: no identity verification — the client accepts arbitrary tool identities and unauthenticated tool definitions. | The client accepted an unsigned, unauthenticated, repository-supplied MCP server definition as a legitimate tool peer. Signed-configuration runtime enforcement (AID-H-021.002, Very High) is named as the direct fix, 'rejecting unsigned, local, or drifted assistant configuration before the client starts tools' — i.e. no identity verification or cryptographic binding existed between the assistant and the tool servers it started.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.12 | Cn-6 0.00: no reversibility classification before execution; automated actions execute ungated (ARCR = 0). | Starting a workspace-defined command-backed tool server, and letting it read cloud identity data and transmit it to an external endpoint, is a delegated-irreversible action — external disclosure that can only be responded to by rotation, never undone. It executed with no pre-execution reversibility determination and no gate of any kind.source: brief |
Unknown, not N/A: 16 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | Supervised autonomy: the assistant executes multi-step coding actions including high-consequence ones (starting tool servers, running commands) with human oversight that is asynchronous — the developer reviews the work, not each action. Held at the 0.75 anchor rather than raised: the fact that the MCP-startup action class had zero human gating in the affected versions is a consent and scope failure already scored in Cn-1, Cn-2 and Cn-6, and inflating Aa for it would double-count the same defect across layers. |
| AsAttack Surface Exposure | 1.00w 0.25 | Matches the 1.00 anchor directly. The assistant is an MCP tool-integrating client whose working context is third-party repository content cloned from the internet — fully untrusted, not partially trusted — and the assessed defect is that this untrusted content was read as control-plane configuration. Maximum exposure: untrusted external ingestion combined with MCP tool integration. elevated |
| CpCascade Potential | 1.00w 0.30 | No System Dependency Graph is published for any affected developer workstation, so the spec's DGC < 0.90 rule applies; the reconstruction independently triggers the 1.00 anchor. An ungated path ran from untrusted repository content to local process execution holding the developer's AWS credentials — a P3/P4-capable node, since those credentials can modify external cloud state and, depending on IAM policy, issue further credentials — and terminated in an external disclosure (a delegated-irreversible action node) with no gate anywhere on the path.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.00w 0.25 | A deterministic vendor fix exists and is the first remediation step: upgrade to a build including language server 1.65.0 or later, which removes the auto-execution behaviour. The accompanying actions (rotating cloud credentials for developers who opened untrusted repositories, egress controls, minimal environments) are incident hygiene and defence-in-depth rather than prerequisites for closing the defect itself. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.30 | Slightly above the 0.25 minimal anchor: the client component, vendor, CVE identifier and the exact affected/fixed version boundary are documented, which is more than a bare vendor-and-owner record. It stays far below the 0.50 'partial provenance' anchor because nothing about the assessed deployment's model, prompt lineage, tool inventory or identity policy is available — and the incident itself is that the tool inventory was not recorded at all. |
| Ec — Public evaluation coverage | 0.29 | coverage 0.30 (7 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-06-26; age 48 days on the workpaper reference date. Components: C_event 0.35 · T_behavior 0.58 · C_monitor 0.65 · T_containment 0.69 · T_calendar 0.83 · C_evidence 0.85. Binding term: C_event. dt_days = 48, measured from the primary disclosure (Wiz, 2026-06-26) to the assessment date 2026-08-13; the AIDEFEND brief republished the analysis on 2026-07-06 without new primary evidence. agentic = true: an Agentic/MCP client whose tool registry and permission boundary mutate at runtime, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist: the assistant maintains session task state and consumes its own tool output in the decision path (closed feedback loop), and its live tool registry is mutable during ordinary operation — the very surface the incident abused. C_event = 0.35 (major): the assessed configuration was superseded by a security fix that changed the tool-startup authority boundary, and for affected deployments credential exposure cannot be ruled out. C_monitor = 0.65: no client-side detection or alerting on workspace-supplied MCP server startup is reported; the prescribed hunt is a filesystem sweep for .amazonq/mcp.json rather than a telemetry query, and discovery came from external research. C_evidence = 0.85: open identity/credential gap — AWS keys and session tokens reachable from the inherited environment remain unresolved until rotated and revoked. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.31 — diagnostic status: Critical evidence limitation. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-021.001 | Client-Side Configuration EnforcementParent AID-H-021 (AI Agent Configuration Integrity & Hardening), dataVersion 2026.08.05. Schema- and policy-checking workspace MCP configuration, and blocking dangerous startup behaviour, is the primary preventive control absent behind Cn-2 = 0.00 and Cn-5 = 0.00. | Very High | Cn-2 Cn-5 |
| AID-H-021.002 | Runtime Integrity Enforcement (Signed Configurations)Parent AID-H-021, dataVersion 2026.08.05. Rejecting unsigned, local or drifted assistant configuration before tool startup is the exact evidence source for a non-zero Cn-5; its absence is why the client accepted an arbitrary repository-supplied tool identity. | Very High | Cn-2 Cn-5 |
| AID-H-034.001 | MCP Server Deployment Profile, Transport & Exposure BaselineParent AID-H-034 (MCP Server Runtime Boundary & Tool Exposure Governance), dataVersion 2026.08.05. Protocol-pure stdio startup, minimal environment inheritance and no shell-mediated launch path for workspace-supplied servers is the control that would lift both Cn-1 and Pr-3. | High | Cn-1 Cn-2 Cn-5 Cn-6 Cn-7 Tr-3 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateParent AID-H-018 (Tool Authorization & Capability Scoping), dataVersion 2026.08.05. Requiring explicit approval before a repository can add a command-capable or credential-reaching tool server is the missing pre-execution gate behind Cn-6 = 0.00. | High | Cn-1 Cn-6 Cn-7 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.08.05. Revoking or rotating the exact long-lived AWS access key, API key or signing key reachable from the inherited environment is one half of what would lift the C_evidence = 0.85 cap. | High | Cn-5 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsParent AID-I-001 (AI Execution Sandboxing & Runtime Isolation), dataVersion 2026.08.05. Default-deny egress would have stopped the malicious MCP startup command from delivering identity data to the attacker endpoint even after it launched. | High | Cn-7 Pr-2 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.08.05. Inventorying affected client and language-server versions and verifying that no vulnerable build remains is the direct evidence behind Rf = 0.00 and the documented half of Tr-4 = 0.25. | High | Ro-4 Tr-4 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationParent AID-E-001, dataVersion 2026.08.05. Revoking already-issued AWS session tokens reachable from the inherited developer environment is the other half of the C_evidence remediation; the brief is explicit that this owner is distinct from disabling a workload principal. | High | Cn-5 |
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingParent AID-H-025 (Unsafe Code Execution Prevention), dataVersion 2026.08.05, maps to Cn-3 in the reconciled catalogue. Flagging MCP configurations that invoke shells, curl, AWS CLI or token reads before startup is a detective complement to the Cn-6 gate. | Medium | Cn-3 |
WHAT THIS CASE TEACHES
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-4 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Sources: AIDEFEND in Action brief — Amazon Q's MCP Auto-Load Bug Made Cloned Repos a Cloud Credential Risk (2026-07-06) · Wiz — Remote Code Execution in Amazon Q for VS Code, Maor Dokhanian (2026-06-26)