Security firm Wiz discovered GhostApproval, a symlink flaw affecting six major AI coding assistants, which allows attackers to bypass approval mechanisms in these tools. The vulnerability was identified in widely used AI-powered development platforms but no specific product names, CVE IDs, or affected versions were disclosed in the report. The flaw exploits improper handling of symbolic links, potentially enabling unauthorized code execution or data exfiltration. No exact timeline, patch status, or exploitation instances in the wild were mentioned. The impact includes circumvention of security controls designed to review AI-generated code before implementation. The research highlights risks in AI-assisted development workflows without further technical specifics.

'GhostApproval' problem highlights human-in-the-loop fails

Researchers at Wiz identified a symlink flaw dubbed 'GhostApproval' in six AI coding assistants, allowing malicious code repositories to execute arbitrary commands on a developer's system. The vulnerability exploits the assistants' approval mechanism, where a seemingly harmless file edit request is redirected to a sensitive file via symlink manipulation. Affected tools include Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack requires user interaction but can lead to full system compromise without explicit warning. No CVE IDs, patch dates, or specific technical payloads were disclosed in the report.

A newly disclosed vulnerability pattern dubbed “GhostApproval” has exposed a critical security flaw in six of the most widely used AI coding assistants: Amazon Q Developer, Anthropic Claude Code , Augment, Cursor, Google Antigravity, and Windsurf, allowing malicious repositories to bypass Human-in-the-Loop safety controls and potentially achieve remote code execution on developer machines. Discovered by Wiz researchers, GhostApproval exploits a deceptively simple but deeply impactful technique: symbolic link following ( CWE-61 ). A symlink is a filesystem pointer that makes one path silently resolve to another. While this primitive has been exploited for decades in Docker escapes ( CVE-2024-21626 ), npm package managers ( CVE-2021-32803 ), and Linux privilege escalation, its application to AI coding agents represents a novel and systematic attack surface. The attack is elegantly simple. An attacker creates a malicious repository containing a symlink , for example, project_settings.json → ~/.ssh/authorized_keys . GhostApproval Attack (Source: Wiz) When a victim clones the repo and asks their AI coding assistant to “set up the workspace,” the agent follows the symlink and writes the attacker’s SSH public key directly to the victim’s authorized_keys file. The result: persistent, password-less SSH access to the developer’s machine. What elevates GhostApproval beyond a straightforward symlink exploit is the UI misrepresentation layer ( CWE-451 ). The most striking example was observed in Anthropic’s Claude Code. GhostApproval Anthropic’s Claude Code (Source: WIZ) During testing, the agent’s internal reasoning explicitly stated: “I can see that project_settings.json is actually a zsh configuration file.” Yet the confirmation prompt displayed to the user simply asked: “Make this edit to project_settings.json?” The agent knew the true target. The user did not. This transforms a sandbox bypass into an informed consent bypass; the Human-in-the-Loop safety net becomes a rubber stamp. Vendor Severity CVE Fixed Version Status Amazon Web Services High CVE-2026-12958 Language server v1.69.0 Fixed Google (Antigravity) Critical Pending v1.19.6 Fixed Cursor Critical CVE-2026-50549 v3.0 Fixed Augment Critical — v0.754.3 In Progress Windsurf Critical — v1.9566 (tested) In Progress Anthropic (Claude Code) Disputed — v2.1.42 Rejected / Patched Three vendors patched the vulnerability promptly: AWS, Cursor, and Google. AWS fixed the issue in language server version 1.69.0 (deployed May 27, 2026) and assigned CVE-2026-12958. The update ships automatically, and customers can trigger it by reloading their IDE. Cursor released its fix in v3.0 (June 5, 2026) under CVE-2026-50549. Google deployed its fix on May 22, 2026, and is assessing whether to issue a CVE. Augment and Windsurf acknowledged the reports but provided no further updates at the time of Wiz publication. Windsurf’s pre-authorization variant was particularly dangerous: the agent writes to disk before the Accept/Reject dialog appears, meaning the confirmation dialog functions as an undo button rather than an authorization gate. Anthropic initially rejected the report as “outside our threat model,” arguing that user-trusted directories and user-approved prompts place responsibility on the user. However, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files. Anthropic later clarified with Wiz that this symlink warning shipped in v2.1.32 on February 5, 2026 — nine days before the report was submitted as part of proactive internal security hardening. Wiz researchers outlined three core mitigations for AI coding tool vendors: Resolve symlinks before displaying prompts — always show the canonical target path, not the symlink name Warn explicitly when the resolved path exits the workspace — a write to ~/.ssh/authorized_keys must look categorically different from a write to ./config.json Never write to disk before explicit user authorization — confirmation dialogs must be gates, not undo mechanisms Initial discovery occurred on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure was made on July 8, 2026, following the 90+ day coordinated disclosure window. GhostApproval is not a collection of individual bugs; it is a category-level design gap across AI coding tools. As agents gain greater autonomy over developer filesystems, the integrity of Human-in-the-Loop controls must be treated as a first-class security requirement, not an afterthought. Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide The post New GhostApproval Vulnerability Affects Amazon Q, Claude Code, Cursor, and Other AI Agents appeared first on Cyber Security News .

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

Cyber security experts at Wiz discovered that a bug in six famous AI coding assistants allows a booby-trapped code project to silently take over a developer’s system. The assistant can ask access to edit one innocent-looking file, but the write takes over a sensitive file. The impacted tools are Windsurf, Google Antigravity, Cursor, Amazon Q Developer, Claude Code by Anthropic, and Augment. Wiz has termed the technique GhostApproval and posted it recently. Three of the six AI assistants have addressed, two did not, while Anthropic argues if it is a bug. The most vulnerable are the tools that modify file before you can notice. Attack tactic The threat actors exploit an old Unix feature called symlink (or symbolic link), that AI assistants cannot check.  A symlink silently directs to other files somewhere else on disk, hence writing to it particularly writes to the victim.  “Symbolic links have been a security headache since the early days of Unix. From /tmp race conditions to privilege escalation exploits, symlinks have a long history of bypassing security boundaries by making one path silently resolve to another. It's a well-documented attack primitive - CWE-61 dates back decades,” Wiz said. Research model Wiz made a malicious repository with a symbolic link called project_settings.json that really directs to target’s SSH login file, ~/.ssh/authorized_keys. The repo’s README commands the assistant to put “a line” to project_settings.json, and this line is the hacker’s SSH key mimicking an innocent setting. “ If you ask the agent to “set up the workspace” or “follow the README,” it writes the key directly via the symlink into the login file. Following this, if the machine plays an SSH  service the threat actor can access, they can sign in without password.  The second variant Another variant of the attack writes to your shell startup file, ~/.zshrc, which the shell runs the next moment you open a terminal without needing an SSH. There are no indications that any of this has been abused in real-time operations, Wiz has only demonstrated it as their research. “Symlinks have been exploited for decades – in race conditions (CVE-2018-15664), in package managers (CVE-2021-32803), in container escapes (CVE-2024-21626). Any time a tool writes to a user-controlled path without resolving it first, symlinks become a weapon,” Wiz wrote in its blog. 

'GhostApproval' problem highlights human-in-the-loop fails

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

Wiz Research uncovered GhostApproval, a trust boundary flaw affecting leading AI coding assistants that can bypass human approval and enable code execution.

'GhostApproval' problem highlights human-in-the-loop fails

'GhostApproval' problem highlights human-in-the-loop fails

Wiz says GhostApproval abuses symlinks so AI coding agents write to SSH keys or shell startup files while showing benign paths.

Security researchers at Wiz have discovered a systematic vulnerability affecting six of the most widely used AI coding assistants, revealing that a classic Unix-era attack vector, the symbolic link, can trick autonomous agents into writing to sensitive files outside their designated workspace. Dubbed GhostApproval, the vulnerability exploits the trust gap between what an AI coding

GhostApproval symlink flaws in major AI coding assistants could hide sensitive file targets, bypass approval checks and enable system access too.

Wiz disclosed GhostApproval, an attack that tricks AI coding assistants into following deceptive symlinks and modifying files outside the intended workspace. The issue was tested against Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Augment, and Windsurf, with some vendors already patching the flaw. #GhostApproval #ClaudeCode #AmazonQDeveloper #Cursor #GoogleAntigravity #Augment #Windsurf...

'GhostApproval' problem highlights human-in-the-loop fails