Researchers warn many AI coding assistants now execute commands from project configurations A high severity flaw in Amazon AI coding assistant for Visual Studio Code meant that opening the wrong Git repository could allow an attacker to execute code on a developer machine and potentially hand them the keys to the dev cloud environment. The bug, tracked as CVE 2026 12957 and assigned a CVSS 4.0 score of 8.5, centers on how Amazon Q handled Model Context Protocol MCP server configurations. Wiz...
