Amazon Q MCP Auto-Execution AWS Credential Theft via CVE-2026-12957
Detects when common developer environments (IDE processes like VS Code or Node.js-based tools) or AI coding assistant tools (e.g., Amazon Q) spawn suspicious child processes (like shells or network tools) that interact with sensitive cloud configuration files, environment variables, or initiate unauthorized network requests.
Splunk (SPL)
