Skip to content
Now taking design partners.Roadmap →
Sekeye

ai_agent · 2026

Amazon Q workspace config exfil

Amazon Q Developer auto-loaded a malicious MCP config committed into a repository (CVE-2026-12957, CVSS 8.5, disclosed by Wiz). The spawned commands inherited the developer's environment, exfiltrating live AWS credentials with no prompt.

Run this campaignScale: AWS credentials in the workspaceBrief updated

What happened

Agent IDEs read configuration from the repository you open. That is a feature, it is how a project ships its own MCP servers so a new engineer gets the right tools automatically. It is also an execution primitive: cloning a repository and opening it can be enough to load an attacker's tool definitions.

In this incident, Amazon Q auto-loaded a workspace-scoped MCP configuration that had been placed in the project. The configured server presented itself as an ordinary developer tool. Once loaded, the agent's tool calls carried AWS credentials out of the developer's environment.

No exploit was required. The configuration file did what configuration files do, and the agent trusted the workspace.

Why this surface is different

Package installs have a mental model around them, engineers know that npm install runs code. Opening a folder does not carry the same intuition, and workspace agent config is not covered by the review that a dependency change would get. The credential exposure comes from the agent's own environment, which already holds cloud credentials because that is what makes it useful.

What a Sekeye campaign does

The template targets agent configuration as inventory:

  1. Agents enumerate MCP server definitions per host across Amazon Q, Cursor, Claude Code, Windsurf, and Continue, including workspace-scoped configs, not just user-global ones.
  2. Servers pointing at unknown egress hosts, or defined inside a repository rather than user configuration, are surfaced as risk indicators.
  3. The blast-radius card shows what that agent could reach: filesystem scope, credential names in its environment, shell, and egress host.

Config-drift alerting and Ask-to-Install for agent surfaces are on the roadmap, the shipping agent reports what it finds and does not intervene.

Rotation guidance

Assume every credential readable from the developer's environment was exposed. Rotate AWS access keys and any assumed-role sessions, then the IdP session, then source-control tokens. Check CloudTrail for use of the affected keys from unfamiliar network paths.

Confirmed against public reporting

Disclosed by Wiz on 26 June 2026 and tracked as CVE-2026-12957 (CVSS 8.5). The Amazon Q Developer IDE extension auto-loaded and executed MCP server configurations without asking. A single .amazonq/mcp.json committed into a repository ran as soon as a developer cloned and opened it.

The spawned commands inherited the developer's full environment, which for anyone working with AWS typically carries access keys, session tokens, and region config. No prompt, no permission dialog, no visible indication. Amazon shipped a protocol update on 12 May 2026; the fix is in version 1.69.0.

Sources