A high-severity flaw in Amazon Q Developer let a malicious
repository run commands and steal a developer's cloud credentials.
The path was short: a developer opens the repo, trusts the
workspace, and Amazon Q does the rest. Amazon has patched it.
Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how
Amazon's AI coding assistant handled Model Context Protocol (MCP)
servers. Wiz
Read more https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html
