Amazon Q VS Extension Flaw Leads to Cloud Credential Theft

A vulnerability in the Amazon Q VS Extension has been discovered, allowing attackers to steal cloud credentials by exploiting the Model Context Protocol (MCP). The flaw stems from the extension’s automatic execution of MCP server configurations without user approval, granting attackers access to sensitive secrets like AWS credentials and API keys. This highlights a growing risk within AI infrastructure and underscores the importance of secure coding practices and developer vigilance.