Amazon Q bug allowed malicious Git repos to steal cloud credentials

Security researchers found that Amazon Q's AI coding assistant could be tricked by booby-trapped Git repositories into executing arbitrary code and exfiltrating cloud credentials. The flaw exploited how the tool processes project configuration files. Amazon has since patched the vulnerability.