Malicious .amazonq/mcp.json File Creation in Cloned Repository (CVE-2026-12957)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects the creation of an Amazon Q Model Context Protocol (MCP) configuration file. This file is used to define tools and resources for Amazon Q, and its creation could indicate a user configuring external tool access for the AI assistant or an adversary attempting to influence its capabilities.