GhostApproval Vulnerability Exposes AI Coding Agents to Classic Symlink Attacks
A critical vulnerability dubbed 'GhostApproval' allows AI coding assistants to bypass sandboxes using symbolic links, potentially leading to remote code execution and SSH key injection.
A significant security flaw, identified as "GhostApproval," has been discovered in at least six popular AI coding assistants, enabling them to access files outside their designated sandboxes. This vulnerability exploits a classic security technique involving symbolic links (symlinks) to potentially achieve remote code execution on a developer's machine. The discovery was made by Wiz, a security firm owned by Google, which reported the issue to affected vendors including Amazon, Anthropic, Augment, Cursor, Google, and Windsurf.
The GhostApproval vulnerability leverages the age-old practice of using symlinks, which act as shortcuts to other files or directories. Attackers can create a malicious repository containing a symlink that appears to point to a harmless configuration file but actually directs the AI agent to a sensitive system file, such as the ~/.ssh/authorized_keys file. When a developer clones this repository and instructs the AI agent to set up the workspace or follow instructions, the agent may inadvertently write malicious content, like an attacker's SSH public key, to the sensitive file, granting the attacker persistent, password-less access.
Wiz researchers highlighted that many of these AI coding tools employ sandboxes or confirmation dialogs to protect users. However, in the case of GhostApproval, the user interface often masks the true, malicious target of the symlink. This deception renders the human-in-the-loop safety mechanism ineffective, as users approve what they believe to be a benign local file edit, while the agent is actually writing to a critical file outside the project's scope.
Several vendors have responded to the vulnerability. Amazon, Cursor, and Google have acknowledged the severity, classifying it as critical or high-severity, and have already released patches or are in the process of issuing CVE identifiers. Amazon, for instance, has assigned CVE-2026-12958 to the flaw in its Q Developer tool. Augment and Windsurf have acknowledged the report but have not yet provided patches or user warnings.
Anthropic's response to the vulnerability has been particularly noteworthy. The company stated that the issue falls "outside our threat model," arguing that users must trust the directory before starting a session. They consider a user explicitly confirming a permission prompt within a malicious directory to be the user's responsibility, not the AI's. While Anthropic noted that current versions of Claude (2.1.173+) do resolve symlinks and warn users, they did not confirm if this change was a direct result of Wiz's report, labeling the initial report as "informative."
This incident underscores a broader "trust-boundary debate" in AI security. While some vendors argue that users are ultimately responsible for the environments they approve, Wiz contends that AI tools should protect users from deceptive workspaces. The fact that Google, AWS, and Cursor treated this as a genuine vulnerability and implemented fixes suggests a consensus among some major players that AI agents should not be tricked into performing actions that violate user trust, even if formal consent is obtained through a deceptive interface.
While there is currently no evidence of active exploitation in the wild, the widespread nature of the vulnerability across popular AI coding assistants poses a significant risk to enterprises that are rapidly adopting these tools. The potential for attackers to inject SSH keys or execute arbitrary code means that developers' machines, and by extension their organizations' codebases and cloud environments, could be compromised.
This new report from The Hacker News expands on the GhostApproval vulnerability by identifying six specific AI coding assistants affected by the symlink flaw. In addition to Anthropic's Claude Code and Amazon Q Developer, the flaw also impacts Augment, Cursor, Google Antigravity, and Windsurf, highlighting a broader risk across the AI development tool landscape.
This new report details specific CVEs assigned to the GhostApproval vulnerability for Amazon Web Services (CVE-2026-12958) and Cursor (CVE-2026-50549), and provides updated patch information. AWS deployed its fix in language server v1.69.0 on May 27, 2026, while Cursor released its patch in v3.0 on June 5, 2026. Google also deployed its fix on May 22, 2026, and Anthropic has since updated its symlink handling in versions 2.1.173+.
This new report from Infosecurity Magazine details that the GhostApproval vulnerability impacts six major AI coding assistants, not just those previously identified. The flaw's ability to bypass approval checks could enable the injection of malicious code into software projects, potentially leading to supply-chain attacks or the introduction of vulnerabilities into AI-generated code.
This new report details the specific AI coding assistants tested, including Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf, confirming that some version of the GhostApproval flaw exists in each. It further elaborates on the varying severity, with some tools writing to disk before any prompt appeared, and highlights Anthropic's initial stance that the issue was outside their security scope, though later versions of Claude Code have since been updated. Amazon, Cursor, and Google have also released patches for this vulnerability, with specific CVEs assigned to some of these fixes.