Amazon Q CVE-2026-12957 MCP Server Auto-Execution from Workspace File

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potentially unauthorized or suspicious child process execution originating from IDEs associated with Amazon Q/CodeWhisperer. The rule monitors for common shell execution (bash, sh, node) or AWS-related command-line activity that may indicate credential harvesting or exfiltration via IDE extensions.