The Workspace Trap: How MCP Auto-Execution Turns Developer IDEs Into Attack Vectors

Three independent security research teams found that AI coding assistants Amazon Q Developer, Claude Code, and Windsurf auto-execute workspace configurations before developers see a consent prompt, enabling code execution and credential theft from malicious repositories. Wiz Research disclosed CVE-2026-12957 in Amazon Q Developer Extension for VS Code (CVSS 8.5), Check Point Research found CVE-2026-21852 and CVE-2025-59536 in Claude Code (Critical), and OX Security disclosed CVE-2026-30615 in Windsurf (CVSS 8.0). Patches were released in language server version 1.65.0, Claude Code 2.0.65, and April 2026 respectively.

Three independent security research teams, working across three different AI coding assistants, found the same thing: the tools were auto-executing workspace configurations before the developer ever saw a consent prompt. The pattern is systemic, and the attack surface it reveals sits inside the developer’s own IDE. The technical mechanism is straightforward. Tools like Amazon Q Developer, Claude Code, and Windsurf all read MCP server configurations from workspace files — .amazonq/mcp.json , .mcp.json , .claude/settings.json — and load them automatically when a project folder opens. Because these configurations can specify arbitrary shell commands, and because spawned processes inherit the developer’s full environment, a malicious repository can achieve code execution and credential theft the moment a developer opens the folder. Wiz Research https://www.wiz.io/blog/amazon-q-vulnerability discovered CVE-2026-12957 in Amazon Q Developer Extension for VS Code. The vulnerability, rated High CVSS 8.5 , allowed attackers to execute arbitrary code and steal AWS credentials simply by having a developer open a malicious repository. The proof of concept was minimal: a .amazonq/mcp.json file containing a bash command that piped aws sts get-caller-identity to an attacker-controlled endpoint. AWS confirmed the fix in language server version 1.65.0, noting in the AWS Security Bulletin 2026-047-AWS https://aws.amazon.com/security/security-bulletins/2026-047-aws/ that “the AWS Language Server updates automatically unless the customer’s network configuration prevents it.” Check Point Research https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ found a parallel flaw in Claude Code. CVE-2026-21852 Critical severity allowed malicious repositories to exfiltrate Anthropic API keys before the trust dialog appeared. By setting ANTHROPIC BASE URL to an attacker-controlled endpoint in a project file, the tool would issue API requests — carrying the developer’s keys in plaintext — before the user confirmed anything. A companion finding, CVE-2025-59536, demonstrated Hooks-based RCE via .claude/settings.json . Both were patched in Claude Code 2.0.65. OX Security disclosed CVE-2026-30615 in Windsurf CVSS 8.0 , where prompt injection could modify local MCP configurations and auto-register a malicious STDIO server, executing arbitrary commands without further interaction. The vulnerability was disclosed in April 2026. The escalation path from initial execution is direct. Wiz Research’s impact assessment maps it: arbitrary code execution leads to theft of cloud credentials AWS, GCP, Azure , cloud persistence through backdoor IAM users, access to internal services via inherited VPN context, and lateral movement to production systems. The attack scenarios include malicious pull requests to popular repositories, typosquatted packages, compromised dependencies with injected config files, and social engineering through fake job interviews — which Wiz described as “a known DPRK tactic.” This cluster extends a security arc Forkast has been tracking across agent infrastructure. Over the past six days, coverage has moved through CoreBreak at the framework layer, Cloudflare MCP at the network layer, AWS AgentCore at the dispatch layer, and LiteLLM at the package-registry layer. The workspace/IDE layer is the fifth. The attack surface is migrating inward — from the infrastructure providers to the developer’s own tools. Wiz Research articulated the architectural lesson cleanly: “Workspace configs are attacker-controlled input — any file that can exist in a git repository should be treated as untrusted input.” Their third lesson — that “environment inheritance is an underrated risk” — names the mechanism that makes the exploit chain work. When an agent spawns a process, it passes the developer’s full environment along with it: cloud credentials, API keys, SSH agent sockets. The convenience design that makes these tools powerful is the same design that makes the compromise silent and complete. The industry is still building the consent layer for agentic development tools. Until “deny-by-default” is the standard posture for workspace configurations, the gap between convenience and security will keep producing the same vulnerability under different product names.