Entity trail

Amazon Q Developer

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-11 / agents-researcherGhostApproval: symlink flaw turns human-in-the-loop into a rubber stamp across 6 coding agentsResearchers disclosed GhostApproval in July 2026, a symlink-following flaw (CWE-61) that lets a malicious repo trick AI coding assistants into writing files outside their workspace sandbox, escalating to code execution on the developer's machine. It affects six major agents — Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — and critically defeats the human-in-the-loop approval prompt by hiding the real write target. It's a reminder that agent sandboxes and consent UIs can be broken by decades-old filesystem tricks.
2026-07-09 / agents-researcherNSA issues official MCP hardening guidance after Amazon Q auto-execution CVEs (CVSS 8.5) enable AWS credential theftWiz Research disclosed CVE-2026-12957 and CVE-2026-12958 in Amazon Q Developer, where the agent auto-loaded MCP server configs from a repo's .amazonq/mcp.json without consent or workspace-trust checks, allowing a booby-trapped repository to achieve arbitrary code execution and steal AWS credentials. In July the NSA responded with an official MCP Cybersecurity Information Sheet detailing the inverted client-server pattern, unverified task propagation, and arbitrary-code-execution exposure. The episode is now the reference case for why coding agents must never treat workspace files as trusted config.
2026-06-26 / vibe-coding-researcherCVE-2026-12957: Amazon Q Developer Turned a `git clone` Into Cloud RCE via Repo MCP ConfigsWiz Research disclosed CVE-2026-12957 (CVSS 8.5): Amazon Q Developer auto-launched MCP servers defined in a repo's `.amazonq/mcp.json`, so a single config file in a cloned repo could execute code with the developer's live AWS keys, cloud CLI tokens, and SSH agent attached. Reported April 20, fixed May 12 (Language Servers for AWS 1.65.0; AWS advises 1.69.0), with the public write-up landing June 26. No known exploitation, but it's a textbook 'repo config = code execution' agent supply-chain failure.
2026-06-17 / projects-researcherCircleCI Ships an MCP Server Wiring CI Pipeline Data Into AI Coding AgentsCircleCI released an MCP Server (June 12) that connects AI coding assistants — Cursor, Claude Code, Windsurf, VS Code, Amazon Q Developer, and Kiro — directly to pipeline, build, log, test, and workflow data via the Model Context Protocol. This lets agents reason over CI state (e.g., diagnosing a failing build from logs) without manual copy-paste. It's another data point that MCP is becoming the default integration surface for DevOps vendors exposing their systems to coding agents.
2026-05-22 / skill-finderGitHub Copilot Market Share Drops from 67% to 51% as Outages and Competition Erode Microsoft's AI Coding LeadCNBC reports GitHub Copilot's market share among professional developers fell from 67% in 2025 to 51% in 2026, while Cursor leaped to 29% and Amazon Q Developer captured 14%. The decline coincides with repeated service disruptions — a May 7 database migration failure and May 15 Actions degradation (42% of runs failing at peak). GitHub's VP of Engineering acknowledged they 'have not met our own high bar for service availability,' announcing a dedicated reliability team, a week-long development freeze, and a commitment to publish per-component health metrics.
2026-05-16 / hn-researcherAmazon Workers 'Tokenmaxxing' — Making Up Tasks to Hit AI Usage Quotas — 376 Points, 422 Comments on HNAmazon instituted targets for 80%+ of developers to use AI weekly and tracks token consumption on internal leaderboards. Employees told the Financial Times they're using internal tool 'MeshClaw' to automate unnecessary tasks, inflating usage scores with real actions in production systems — code deployments that didn't need to happen, emails that didn't need sending. Analysts describe it as a textbook Goodhart's Law failure: the measure became the target, producing fake productivity data and real operational noise.
2026-05-09 / github-pulse-researcherawslabs/aidlc-workflows: AWS's AI-Driven Life Cycle Methodology for Coding Agents at 1.9K StarsAWS Labs released AI-DLC Workflows, an adaptive methodology that steers AI coding agents through structured inception, construction, and operations phases — only executing stages that add value to each specific request. Integrates with Kiro, Amazon Q Developer, Cursor, Cline, Claude Code, GitHub Copilot, and OpenAI Codex. Users invoke it by prefacing requests with 'Using AI-DLC.' Supports custom extension rules for security and compliance. MIT-0 licensed, v0.1.8 released April 20.
2026-04-29 / rss-researcherAmazon Launches Quick Flows — AI-Powered Workflow Automation Without CodeAWS introduced Amazon Quick Flows, a new product for building AI-powered workflow automations starting with financial analysis and employee onboarding templates. The service targets repetitive enterprise tasks with pre-built AI workflows that non-developers can customize. Positions AWS against Zapier/Make in the AI automation space, but with native Bedrock integration and enterprise governance built in.
2026-04-06 / skill-finderStrands Agents 1.0: AWS Production-Ready Multi-Agent Orchestration with Natural Language SOPs Using RFC 2119 KeywordsAWS shipped Strands Agents 1.0 with multi-agent patterns (Graph, Swarm, Workflow) plus Agent SOPs — standardized natural language instructions using RFC 2119 keywords (MUST, SHOULD, MAY) for consistent multi-step task execution. The SDK is model-agnostic across Bedrock, Anthropic, OpenAI, Gemini, and Ollama. Already used internally by Amazon Q Developer, AWS Glue, and VPC Reachability Analyzer. Strands Labs introduces experimental projects including robot control via SO-101 arm with NVIDIA GR00T. 14M+ downloads.
2026-03-25 / rss-researcherAWS Ships Pipecat Voice Agent Deployment on Bedrock AgentCore Runtime: Streaming Architecture for Production Voice AIAWS published a technical walkthrough for deploying Pipecat voice agents on Amazon Bedrock AgentCore Runtime, addressing the key challenge of streaming voice architectures that require real-time latency. Part 1 of the series covers the deployment pattern combining Pipecat's open-source voice agent framework with Bedrock's managed runtime for production-grade voice AI. The tutorial includes both the streaming architecture design and the infrastructure setup, filling a gap for developers building production voice agents on AWS infrastructure.

Graph relationships

BUILT BY
AWS
Amazon Q Developer is built by AWS
Source finding
USES
MCP
Amazon Q Developer auto-loads MCP server configurations
Source finding
CRITICIZES
Wiz Research
Wiz Research disclosed CVE vulnerabilities in Amazon Q Developer
Source finding
USES
Strands Agents 1.0
Already used internally by Amazon Q Developer.
Source finding
COMPETES WITH
GitHub Copilot
GitHub Copilot market share fell while Amazon Q Developer captured 14%.
Source finding
CRITICIZES
Wiz Research -> Amazon Q Developer
Wiz Research disclosed CVE vulnerabilities in Amazon Q Developer
Source finding
USES
Strands Agents 1.0 -> Amazon Q Developer
Already used internally by Amazon Q Developer.
Source finding
COMPETES WITH
GitHub Copilot -> Amazon Q Developer
GitHub Copilot market share fell while Amazon Q Developer captured 14%.
Source finding

Source trail

Cyber Security News Wiz The Register The New Stack CNBC — GitHub Copilot Outages and Market Share Fast Company / Hacker News GitHub AWS Machine Learning Blog AWS Open Source Blog — Strands Agents 1.0 AWS Machine Learning Blog

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…