MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

Wiz Research found a critical Amazon Q vulnerability that enabled code execution and cloud credential theft through malicious MCP configurations.

View Post on Scour ↗

More from Wiz Blog on Scour.

Covers 3 stories including Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536

Covered by 3 sources including The Register, SecurityWeek