Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-26 · source-backed
The Amazon Q bug is one instance of a 2026 pattern: MCP configuration carried in repositories is now an RCE supply-chain vector, not just untrusted tool output. Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based auto-launch attacks (Windsurf reportedly exploitable with zero user interaction). VIPER-MCP's scan of ~40K repos produced 67 CVEs. We solved this for package managers with lockfiles and signatures. The MCP config layer has none of that yet.
Each link below shares sources, entities, or timing with this story.
Windsurf uses MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Windsurf uses MCP); both cover Claude Code, CLI, Cursor, MCP; overlapping topics (claude, code, config, configuration, cursor).
Linked by a graph relationship (Windsurf uses MCP); both cover Claude Code, Cursor, MCP, VS Code; overlapping topics (amazon, attack, claude, code).
Windsurf uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Windsurf uses MCP); both cover Claude Code, CLI, Cursor, IDE; overlapping topics (claude, code).
Google acquired Windsurf / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google acquired Windsurf); both cover Claude Code, CLI, Cursor, IDE; overlapping topics (claude, code).
Cursor benchmarked against Windsurf / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Cursor benchmarked against Windsurf); both cover Claude Code, CLI, Cursor, IDE; overlapping topics (claude, code, cursor).
Adversa AI criticizes Windsurf / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Adversa AI criticizes Windsurf); both cover Claude Code, Cursor, MCP, RCE; overlapping topics (claude, code, config, cursor).
Cursor benchmarked against Windsurf / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor benchmarked against Windsurf); both cover Cursor, CVEs, IDE, RCE; overlapping topics (attack, code, cursor, cves).
Google acquired Windsurf / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google acquired Windsurf); both cover Claude Code, CLI, Cursor, Gemini; overlapping topics (claude, code, cursor, windsurf).