GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

# GhostApproval: How AI Coding Agents Fall Victim to Symlink Attacks

Security researchers at Wiz have disclosed a critical vulnerability affecting six of the most popular AI coding assistants—exposing developers to unauthorized SSH key injection and shell code execution. Dubbed GhostApproval, the flaw exploits an informed-consent bypass where the approval dialog shows developers the wrong filename, tricking them into approving writes to sensitive system files. The vulnerability affects Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

## The Attack Mechanism

GhostApproval hinges on a deceptively simple exploit chain that leverages Unix symbolic links (symlinks) combined with flawed approval dialogs in AI coding assistants.

How it works in practice:

A malicious repository contains a symlink named project_settings.json that secretly points to ~/.ssh/authorized_keys—the file controlling SSH access to a developer's machine. When the AI assistant is asked to "set up the workspace" or "follow the README," it processes a request to add a line to project_settings.json. The assistant writes the attacker's SSH public key directly through the symlink into the authorization file.

A second variation targets shell startup files like ~/.zshrc, which execute automatically when a terminal opens. No SSH access or network connectivity is required for this variant to run arbitrary commands on the next login.

The attack is trivial to execute and requires no special privileges. A developer need only:

1. Clone or interact with a malicious repository

2. Ask the AI assistant to edit or configure files

3. Approve the file modification when prompted

4. Allow the symlink to do the rest

## The Real Vulnerability: Informed-Consent Bypass

While symlink attacks date back decades, the critical flaw lies not in the symlink itself but in how these tools present information to developers. The approval dialog shows the wrong filename.

Wiz's testing of Claude Code revealed that the agent internally recognized the true target—noting in its own reasoning that project_settings.json was "actually a zsh configuration file"—yet displayed only the harmless filename to the developer. The developer clicks Accept, believing they're editing a local config file, and the write lands on a sensitive system file instead.

This represents a textbook informed-consent bypass: the human remains in the loop, but the loop is fed false information.

### Tool-by-Tool Breakdown

| Tool | Status | CVE | Severity |

|------|--------|-----|----------|

| Amazon Q Developer | ✅ Fixed | CVE-2026-12958 | High |

| Cursor | ✅ Fixed | CVE-2026-50549 | High |

| Google Antigravity | ✅ Fixed | Pending | High |

| Claude Code | ⚠️ Disputed | — | High |

| Augment | ❌ Unfixed | — | Critical |

| Windsurf | ❌ Unfixed | — | Critical |

Critical distinction: Some tools are worse than others. Windsurf writes files to disk *before* the approval dialog appears—the prompt becomes merely an undo button after the damage is done. Augment displays no dialog at all, silently reading and modifying files outside the project directory. Even tools that retain an approval screen remain vulnerable because the screen lies.

## Wiz's Responsible Disclosure

Wiz published its findings on July 8, 2026, after reporting the vulnerability privately to all six vendors. Three have released patches:

Two vendors have acknowledged the issue but released no patch:

Anthropic's position adds nuance: the company disputes the classification, arguing the scenario falls "outside our threat model." Anthropic's reasoning: developers explicitly chose to trust the folder when launching the session and then approved the edit, so the decision was theirs. The company notes that Claude Code included symlink warnings in early February 2026—before Wiz's private report—as routine hardening. However, Wiz's testing showed that warning was insufficient; the core issue (approval dialog showing the wrong file) remains unaddressed.

## Real-World Implications

This vulnerability represents a novel supply-chain attack vector in an era when developers increasingly rely on AI assistants for daily work.

Who is at risk:

Attack surface expansion:

An attacker doesn't need to compromise the AI vendor's infrastructure. Instead, they poison a single repository—whether a fork of an open-source project, a private package, or a deliberately public honeypot—and wait for developers to run an AI assistant against it. The barrier to entry is extremely low.

## Recommendations

For developers (immediate):

For organizations:

For vendors:

---

## HackWire Analysis

GhostApproval exposes a fundamental tension in how AI coding agents balance autonomy with safety. The vendors' varying responses reveal deeper disagreements about threat modeling in an AI-assisted development world.

Anthropic's position—that developer intent matters, therefore the approval suffices—misses the point. Informed consent requires accurate information. An approval dialog that names the wrong file is worse than no dialog at all; it creates false confidence. The fact that vendors initially missed this vulnerability suggests they shipped these tools without adequately modeling symlink attacks, which have been a staple of Unix security for over 30 years.

What strikes us most is the *pattern*: as AI agents gain power to modify files, run commands, and access credentials, their security boundaries are lagging behind. We've seen similar gaps in other AI agent research—privilege escalation through misaligned tool use, prompt injection attacks on agent reasoning, and agents writing to unintended locations. GhostApproval is the first to achieve end-to-end system compromise through a single approval bypass, but it likely won't be the last.

The broader risk is adoption velocity outpacing security hardening. Developers are integrating these tools into their daily workflows before vendors have tested against standard attack patterns. Symlink traversal is not exotic; it's Unix 101. That Wiz had to report it separately to six vendors suggests these tools entered production without basic file-system security review.

This is a tractable problem—all three vendors who've patched already fixed it. But the incident underscores that AI coding agents are now critical infrastructure in developer workflows, and they need the security rigor of production systems, not experimental tools. Vendors should publish their threat models explicitly, vendors and enterprises should invest in file-integrity monitoring, and developers should treat AI-generated code changes with the same skepticism they'd apply to untrusted pull requests.

— *HackWire Editorial*

---

## Related Coverage