A systematic security vulnerability has been discovered across multiple AI coding assistants, revealing how developer productivity tools can become attack vectors through automatic workspace configuration execution. Security researchers from three independent teams identified identical exploitation patterns in Amazon Q Developer, Claude Code, and Windsurf, demonstrating a fundamental security design flaw in AI-powered development environments.

The vulnerability mechanism operates through Model Control Protocol (MCP) server configurations that AI coding tools automatically process when developers open project directories. These tools read configuration files such as .amazonq/mcp.json, .mcp.json, and .claude/settings.json without user consent, executing any shell commands specified within these files using the developer's full system privileges.

Wiz Research documented CVE-2026-12957 affecting Amazon Q Developer Extension for VS Code, assigned a High severity rating with CVSS score 8.5. The exploitation method requires minimal setup: a malicious repository containing a .amazonq/mcp.json file with bash commands that extract AWS credentials using 'aws sts get-caller-identity' and transmit them to attacker-controlled endpoints. Amazon Web Services acknowledged the vulnerability and implemented fixes in language server version 1.65.0, with automatic updates deployed unless network configurations prevent them.

Check Point Research identified corresponding vulnerabilities in Claude Code, including CVE-2026-21852 rated as Critical severity. This flaw enables API key exfiltration before security dialogs appear by manipulating the ANTHROPIC_BASE_URL environment variable in project files, causing the tool to send API requests containing plaintext developer credentials to malicious servers. An additional finding, CVE-2025-59536, demonstrated remote code execution capabilities through configuration hooks in .claude/settings.json files. Anthropic addressed both issues in Claude Code version 2.0.65.

OX Security disclosed CVE-2026-30615 in Windsurf, scoring CVSS 8.0, where prompt injection techniques could modify local MCP configurations and automatically register malicious STDIO servers that execute arbitrary commands without further user interaction. This vulnerability was disclosed in April 2026.

The attack progression follows a systematic escalation pattern beginning with arbitrary code execution and advancing to comprehensive system compromise. Initial access enables theft of cloud credentials across major platforms including AWS, Google Cloud Platform, and Microsoft Azure. Attackers can establish persistence through backdoor IAM users, access internal services via inherited VPN contexts, and perform lateral movement to production systems using the developer's network privileges.

Threat scenarios encompass various attack vectors including malicious pull requests targeting popular repositories, typosquatted packages containing injected configuration files, compromised software dependencies, and social engineering campaigns such as fraudulent job interviews—a tactic reportedly employed by North Korean threat actors according to security intelligence.

This vulnerability cluster represents part of a broader security trend affecting agent infrastructure across multiple layers. The attack surface has progressively migrated from external infrastructure providers toward developer tools and integrated development environments, creating new categories of insider threats that exploit trusted development workflows.

The fundamental security issue stems from treating workspace configurations as trusted input when they should be classified as potentially malicious data, equivalent to any file that can exist within version control repositories. The convenience features that make AI coding assistants powerful—automatic configuration loading and environment inheritance—simultaneously create comprehensive compromise opportunities.

When AI agents spawn processes, they inherit the developer's complete environment including cloud credentials, API keys, SSH agent sockets, and network access privileges. This design choice enables seamless integration with existing development workflows but also ensures that successful exploitation provides attackers with extensive system access and credential theft capabilities.

The industry currently lacks standardized consent mechanisms and security frameworks for agentic development tools. Until deny-by-default security postures become standard for workspace configuration handling, similar vulnerabilities will likely emerge across different AI coding assistant products, highlighting the critical need for improved security architectures in AI-powered development environments.

Related Links:

• Infrastructure
• Trust & Security
• Models
• Agents at Work