Threat
Amazon Q VS Extension Flaw Leads to Cloud Credential Theft
Publication date not yet evaluated · Added darkreading.com
Page published
Coverage timeline
Single-source incident — one report is available.
Why it matters
AI coding assistants and their MCP integrations expand the attack surface, allowing a poisoned repository to trigger code execution and cloud credential theft on a developer's machine.
A vulnerability in the Amazon Q Visual Studio extension could let adversaries plant a malicious repository that executes arbitrary code and steals cloud credentials, highlighting growing MCP-related risk.