AI Coding Assistants Expose Credentials and Enable Malware Execution

Researchers disclosed two high‑severity flaws in popular AI‑driven coding assistants. In Amazon Q Developer Extension for VS Code, the tool automatically loaded configuration files from any opened workspace, allowing attackers who supplied a malicious repository to steal AWS access keys, secret keys and other cloud tokens. The vulnerabilities (CVE‑2026‑12957 and CVE‑2026‑12958) were reported by Wiz on 17 April 2026 and patched by Amazon in May 2026 across IDE plugins.

A separate proof‑of‑concept by Mozilla's Zero Day Investigative Network (0DIN) showed that Claude Code could be tricked into running a reverse shell when cloning a clean‑looking GitHub repository. The attack chain relied on an innocuous setup error, an automatically executed init command, and a DNS‑controlled script that opened a shell with the developer’s privileges. No malicious code resides in the repository, making the method hard to detect.

Both findings highlight the growing risk that AI‑assisted development tools can execute untrusted code or configurations without explicit user consent, exposing sensitive credentials and providing a foothold for attackers. Experts recommend tighter trust boundaries, explicit user prompts for any external configuration loading, and transparent logging of commands executed by AI agents.