Security firm Wiz discovered GhostApproval, a symlink flaw affecting six major AI coding assistants, which allows attackers to bypass approval mechanisms in these tools. The vulnerability was identified in widely used AI-powered development platforms but no specific product names, CVE IDs, or affected versions were disclosed in the report. The flaw exploits improper handling of symbolic links, potentially enabling unauthorized code execution or data exfiltration. No exact timeline, patch status, or exploitation instances in the wild were mentioned. The impact includes circumvention of security controls designed to review AI-generated code before implementation. The research highlights risks in AI-assisted development workflows without further technical specifics.

Researchers at Wiz identified a symlink flaw dubbed 'GhostApproval' in six AI coding assistants, allowing malicious code repositories to execute arbitrary commands on a developer's system. The vulnerability exploits the assistants' approval mechanism, where a seemingly harmless file edit request is redirected to a sensitive file via symlink manipulation. Affected tools include Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack requires user interaction but can lead to full system compromise without explicit warning. No CVE IDs, patch dates, or specific technical payloads were disclosed in the report.

GhostApproval showed six mainstream coding assistants would follow a symlink past their own approval dialog. Five checks before we point one at a repo.

A category-level flaw in six major AI coding tools landed with a thud in July. The more interesting story is what the bug says about treating agent-written code, and the agents themselves

GhostApproval is a vulnerability pattern in AI coding assistants where a symlink can make a benign-looking file prompt actually target a sensitive destination like ~/.ssh/authorized_keys. Researchers demonstrated the issue in Claude Code, Cursor, and Google’s Antigravity, and also showed that some approval dialogs can display misleading paths or even approve changes after the write has already happened. #GhostApproval #ClaudeCode #Cursor #Antigravity #authorized_keys

Three critical attack vectors converged in July 2026: the GhostApproval symlink vulnerability in six AI coding assistants, 14 new critical CVEs in Ubiquiti UniFi released over 48 hours, and the UNK_MassTraction threat cluster actively exploiting Roundcube to target physics and engineering department

Wiz says GhostApproval abuses symlinks so AI coding agents write to SSH keys or shell startup files while showing benign paths.

'GhostApproval' problem highlights human-in-the-loop fails

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

Original article from dbhyeong.github.io

セキュリティ研究企業のウィズは、主要な6つの<a href="https://tech-matome.com//?tag=ai%e3%82%b3%e3%83%bc%e3%83%87%e3%82%a3%e3%83%b3%e3%82%b0%e3%82%a2%e3%82%b7%e3%82%b9%e3%82%bf%e3%83%b3%e3%83%88"><a href="https://tech-matome.com//?tag=ai%e3%82%b3%e3%83%bc%e3%83%87%e3%82%a3%e3%83%b3%e3%82%b0"><a href="https://tech-matome.com//?tag=ai">AI</a>コーディング</a>アシスタント</a>において、悪意のあるリポジトリを利用して開発者のマシンを乗っ取ることが可能な脆弱性が存在すると発表しました。ゴーストアプルーバルと名付けられたこの手法は、シンボリックリンクを悪用することで、<a href="https://tech-matome.com//?tag=ai%e3%82%a8%e3%83%bc%e3%82%b8%e3%82%a7%e3%83%b3%e3%83%88">AIエージェント</a>の承認画面に表示されるファイル名と実際に書き換えられるファイルをすり替えるものです。開発者が設定ファイルの編集と認識して承認ボタンを押すと、実際にはSSH認証鍵やシェルの設定ファイルが書き換えられ、攻撃者に遠隔操作権限を奪われる恐れがあります。 調査の結果、アマゾンQデベロッパー、カーソル、グーグルアンチグラビティは既に修正版を公開していますが、オーグメントとウィンドサーフは対応が遅れています。また、アンスロピックのクロードコードについては、設計上の解釈を巡って開発側と研究者の間で議論が続いています。この問題は、AIエージェントの内部推論が正しい情報を得ていても、ユーザーへの提示情報が不正確である場合にセキュリティ対策が形骸化する構造的な欠陥を示しています。開発者は信頼できないリポジトリに対して安易に<a href="https://tech-matome.com//?tag=ai%e3%83%84%e3%83%bc%e3%83%ab">AIツール</a>を実行しないよう注意が必要です。

Blog sobre seguridad de la informacion, ethical hacking, pentest

Podíváme se na to, jak Ghost Phishing obchází skenování obsahu stránek, na chybu GhostLock v Linuxu i na GhostApproval zneužívající symbolické odkazy. Podíváme se ale i na činnost hackerských skupin.

Podíváme se na to, jak Ghost Phishing obchází skenování obsahu stránek, na chybu GhostLock v Linuxu i na GhostApproval zneužívající symbolické odkazy. Podíváme se ale i na činnost hackerských skupin.

GhostApproval symlink flaws in major AI coding assistants could hide sensitive file targets, bypass approval checks and enable system access too.