MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

What it is

A high-severity vulnerability in the Amazon Q Developer extension for VS Code, discovered by Maor Dokhanian (Wiz). Opening a malicious repository could yield arbitrary code execution and AWS credential theft. Amazon fixed it in language server version 1.65.0. The summary already covers the mechanism (.amazonq/mcp.json auto-loaded with no consent, full environment inheritance) and the PoC (aws sts get-caller-identity); what follows is what it omits.

What to do

Per AWS's public statement, the fix ships through the language server, not the plugin, and updates automatically for most users:

• The AWS Language Server auto-updates unless the customer's network blocks it — no action required in most cases.
• To force it on an existing install, reload the IDE, which triggers an update to the latest language server.
• If auto-update is blocked, upgrade the Amazon Q Developer plugin for your IDE.
• New installs pull the patched version automatically.

This matters for the act/don't-act decision: an org that thinks it must manually bump a plugin version may already be patched via silent language-server updates — unless egress filtering has been silently blocking those updates, in which case reloading won't help and the plugin must be upgraded directly.

Wiz's residual-risk guidance for developers, even when patched:

• Treat unfamiliar repositories as untrusted.
• When Amazon Q shows an "Untrusted MCP Server" warning, inspect the command before allowing — the fix is a consent prompt, so it can still be click-through approved.
• Check cloned repos for unexpected .amazonq/ folders.
• Audit existing MCP server configurations in your environment.

Preconditions / Affected

Amazon Q extension active in VS Code on a language server before 1.65.0, plus a workspace containing an attacker-controlled .amazonq/mcp.json. Trigger requires opening the folder and activating Amazon Q. Developer must have live cloud credentials in the environment for the credential-theft escalation to land.

Caveats

• The remediation is a consent prompt, not removal of auto-loading — protection depends on the user reading and rejecting the "Untrusted MCP Server" dialog rather than reflexively approving.
• This is not isolated to Amazon Q: Wiz notes independent findings by OX Security and Check Point around the same time, framing MCP auto-execution as a systemic pattern across AI coding tools. If you run other MCP-enabled assistants (e.g. Copilot), the same trust-boundary question applies and is not addressed by the 1.65.0 fix.