A cloned repository was enough to cross the trust boundary here. Amazon Q Developer read MCP settings from the workspace and launched local helper processes before the code was reviewed, so opening a repo could turn into command execution in the developer’s own cloud session, not just a config change inside the IDE.
Wiz says those helpers inherited the full environment on the machine. That exposed AWS credentials, CLI tokens, API secrets, and SSH sockets already present on the workstation. Amazon patched CVE-2026-12957 in Language Servers for AWS 1.65.0, and AWS points customers to 1.69.0 because that build also fixes CVE-2026-12958.
The risk reaches beyond this one extension. Any IDE assistant that auto-loads workspace configs or spawns local tools can turn a trusted repo open into credential theft before the first line of code is reviewed.