A newly disclosed vulnerability pattern dubbed GhostApproval affects six major AI coding assistants, allowing malicious repositories to trick agents into writing files outside their designated workspace sandbox, potentially leading to remote code execution on developer machines.
Wiz researchers found the flaw impacts Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.
The vulnerability combines a decades-old Unix attack primitive with a novel AI-specific twist: agents that correctly identify dangerous file targets internally, yet present misleading confirmation prompts to users.
GhostApproval Flaw
GhostApproval exploits symbolic link following (CWE−61), a well-documented technique where a file path silently resolves to a different location.
Attackers craft a malicious repository containing a symlink disguised as an innocuous file, such as project_settings.json, that actually points to ~/.ssh/authorized_keys.
When a victim clones the repository and asks their AI assistant to “set up the workspace,” the agent follows README instructions and writes attacker-controlled content, such as an SSH public key, to the resolved target rather than the visible filename, granting the attacker persistent, password-less SSH access.
The more troubling layer is CWE−451, UI Misrepresentation of Critical Information. In Claude Code, for instance, the agent’s internal reasoning stated it recognized project_settings.json as “actually a zsh configuration file”.
Yet the user-facing prompt simply asked, “Make this edit to project_settings.json?” The Human-in-the-Loop safeguard becomes a rubber stamp when the agent knows the truth, but the user doesn’t.
Some tools exhibited even worse behavior than a simple misleading prompt. Windsurf wrote malicious payloads to disk before displaying any Accept/Reject dialog, making the confirmation prompt purely cosmetic since the compromise had already occurred by the time the user saw it.
Augment went further still, performing both symlink reads and writes with zero user confirmation at all, silently exfiltrating credentials and injecting SSH keys without ever presenting a permission dialog.
Amazon Q sat in between these extremes, writing files pre-authorization but at least offering an “Undo” option after the fact.
Three vendors fixed the issue promptly. AWS patched the Amazon Q Developer language server in version 1.69.0, assigning CVE-2026-12958 to track the fix.
According to Wiz, Cursor addressed the flaw in version 3.0 and issued CVE−2026−50549. Google patched Antigravity in version 1.19.6 and is currently assessing whether to issue a formal CVE.
Two vendors acknowledged receiving the report but have not shipped fixes as of publication. Augment’s status remains “in progress” without a confirmed release date, while Windsurf acknowledged the report on June 23, 2026, and has provided no further update since.
Anthropic initially rejected the finding as “outside our current threat model,” arguing that users implicitly accept risk once they trust a directory and approve a permission prompt inside it.
The company later confirmed, however, that Claude Code versions 2.1.32 and later, which shipped before the report was even filed, include symlink warnings as part of proactive security hardening, though it declined to directly link this change to the disclosure.
Mitigation
Wiz recommends that AI coding tools resolve symlinks before displaying any confirmation dialog, explicitly flag writes targeting paths outside the workspace so a system file write looks visibly different from a local edit, and never write to disk before receiving explicit user authorization.
The disclosure timeline ran from initial discovery in February 2026 through public release on July 8, 2026, with vendor responses ranging from rapid remediation within months to prolonged silence, underscoring inconsistent security postures across the fast-growing AI coding assistant market.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
