MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments.