Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-26 · source-backed
Wiz Research disclosed that Amazon Q Developer auto-launched MCP servers defined in a repo's .amazonq/mcp.json, so a single config file in a cloned repo could execute code with your live AWS keys, cloud CLI tokens, and SSH agent attached. Reported April 20, fixed May 12, public writeup June 26. No known exploitation, but it's a textbook "repo config equals code execution" failure. The defense is concrete: treat any MCP config shipped inside a repo as untrusted code, disable auto-start of repo-defined servers, require explicit approval before spawning them.
Each link below shares sources, entities, or timing with this story.
Amazon released AWS / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Amazon released AWS); both cover Amazon, AWS, CVE, Developer; cite the same source (defense).
Amazon supports Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Amazon supports Claude Code); both cover AWS, CLI, CVSS, MCP; overlapping topics (agent, code).
Anthropic partners with Amazon / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Anthropic partners with Amazon); both cover CVE, CVSS, MCP, RCE; overlapping topics (code, server).
Amazon supports Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Amazon supports Claude Code); both cover MCP, RCE, SSH; overlapping topics (agent, code, config, repo, server).
Linked by a graph relationship (Amazon supports Claude Code); both cover CVE, CVSS, MCP, RCE; overlapping topics (agent, code).
Amazon supports Claude Code / Shared entities / Shared topic / Tension
Linked by a graph relationship (Amazon supports Claude Code); both cover CLI, MCP, RCE; overlapping topics (amazon, code, config).
Amazon released AWS / Shared entities / What happened next
Linked by a graph relationship (Amazon released AWS); both cover AWS, CVE, CVSS, RCE; picks up the AWS thread on 2026-07-11.
Amazon supports Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Amazon supports Claude Code); both cover CVE, CVSS, RCE; overlapping topics (agent, code, config).