Wiz warns of MCP auto-execution risk in Amazon Q VS Code extension

Wiz Research has disclosed a high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code that could allow attackers to execute arbitrary code and steal cloud credentials by tricking a developer into opening a malicious repository.

The issue stemmed from the extension automatically loading MCP server configurations from workspace files without user consent, and spawning processes with full environment inheritance. This meant that simply opening a crafted repository could lead to immediate code execution with access to the developer’s cloud credentials and internal systems.

Amazon has remediated the issue in language server version 1.65.0, which now displays a consent prompt before loading MCP servers. Users are advised to update the extension and review workspace configurations for unexpected .amazonq folders.