Back to amy_yunduo's feed
馃攲MCPWiz BlogContent type: Blog

MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension (opens in new tab)

Covers聽3聽stories See all stories this covers聽including聽Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536Covered by聽3聽sources See all sources covering this story聽including聽The Register, SecurityWeek

Wiz Research found a critical Amazon Q vulnerability that enabled code execution and cloud credential theft through malicious MCP configurations.

Read the original article
Sign in to keep reading the full article.
Sign UpLog In

Covered in 3 articles

The Register路

Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds

Feeds
SecurityWeek路

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

Feeds
The Hacker News路

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

Feeds

Keyboard Shortcuts

Navigation

Next / previous post
j/k
Open post
oorEnter
Preview post
v

Post Actions

Love post
a
Like post
l
Dislike post
d
Undo reaction
u
Save / unsave
s

Recommendations

Add interest / feed
Enter
Not interested
x

Go to

Home
gh
Interests
gi
Feeds
gf
Likes
gl
History
gy
Changelog
gc
Settings
gs
Discover
gb
Search
/

General

Show this help
?
Submit feedback
!
Close modal / unfocus
Esc

Press ? anytime to show this help