Amazon Q MCP auto-load

When: Disclosed / patched spring 2026 (CVE-2026-12957, CVE-2026-12958)
Surface: Amazon Q Developer / AWS language servers · workspace MCP config
Class: Excessive trust — opening a malicious repo silently loaded MCP and inherited the developer environment

Per Wiz / Cybersecurity News reporting and the awesome-ai-agent-attacks timeline: MCP configs under .amazonq/mcp.json could auto-load without consent or workspace-trust checks; symlink issues compounded the blast radius. Spawned processes inherited AWS keys, session tokens, cloud CLI tokens, API secrets, and SSH agent sockets.

Without Relay

“Opening the repo” was enough to attach attacker-chosen tools with the engineer’s full credential environment.
No org allowlist decided which MCP servers/tools were permitted for that seat.
Credential files remained readable to whatever the agent (or MCP server) proposed next.

How Relay could have safeguarded

Layer	What to configure	Effect on this path
MCP control	Default deny; allow only known org servers/tools by exact id or glob	Unexpected MCP tools from a poisoned repo never get an allow
Path control	Deny `.env`, `.aws/`, `credentials`, `id_rsa`, `.ssh/`, `kube/config`	Agent / tools cannot Read secrets into context
Bash control	Deny `curl \|`, `scp` , `printenv`, exfil patterns; Soft ask on `aws` mutate	Shell fallback cannot dump or ship secrets
Privilege Streak	Escalate on secrets-path + admin MCP names	Credential-hunting streaks open Guards incidents
Audit	Filter Live by MCP deny / behavior	Security sees the first blocked tool, not a days-later IAM surprise

Retro checklist

Treat workspace-supplied MCP as untrusted until allowlisted in Relay Rulebook.
Keep prod cloud CLIs on Soft ask / deny for feature-team seats.
Pair with vendor patches—Relay is defense in depth, not a substitute for upgrading Q / language servers.
After a near-miss, export the MCP deny trail for the security postmortem.

Related: MCP · Path · Privilege Streak · Case studies overview