AI Coding Agents Exposed by Symlink Flaw That Tricks Developers Into Approving the Wrong File

A security flaw discovered by researchers at Wiz allows malicious code repositories to hijack a developer's computer through six popular AI coding assistants — and the approval box designed to stop it is part of the problem.

Published on July 8, 2026, the vulnerability pattern — dubbed GhostApproval — affects Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Three vendors have issued fixes, two have acknowledged the issue without patching it, and Anthropic disputes the finding altogether.

The discovery arrives at a moment when AI coding agents are becoming standard tools in professional software development. Millions of developers now rely on these assistants to read files, execute setup instructions, and modify project configurations autonomously. That expanded access, researchers warn, is precisely what makes this class of attack so dangerous. Understanding the risks and challenges of AI adoption in business has never been more urgent — and GhostApproval illustrates why complacency around agentic tools carries real consequences.

How a Decades-Old Unix Trick Becomes a Modern Weapon

The attack exploits a symbolic link — commonly called a symlink — a feature built into Unix-based operating systems that quietly redirects one file path to another location on disk. Writing to a symlink does not alter the file you see in the directory. It alters whatever target file the symlink points to.

Wiz constructed a malicious repository containing a symlink named project_settings.json that actually pointed to ~/.ssh/authorized_keys — the file that controls who can log into a machine over SSH. The repository's README instructed the AI assistant to add "a line" to project_settings.json. That line was the attacker's own SSH key formatted to look like an ordinary configuration setting.

When a developer asked the agent to "set up the workspace" or "follow the README," the agent wrote the attacker's key directly through the symlink and into the SSH login file. If the machine ran an accessible SSH service, the attacker could then log in without a password.

A second variant targeted ~/.zshrc, the shell startup file that executes automatically every time a developer opens a terminal. No SSH access is required for that version to deliver its payload.

Wiz notes there is no evidence GhostApproval has been used in real attacks. The research is being presented as a proof-of-concept to drive industry-wide fixes.

Why Symlinks Are So Effective as an Attack Vector

Symlinks are not exotic or obscure — they are a routine part of how Unix-based systems organise files. Developers encounter them constantly in normal project structures, which is precisely what makes them so effective as a concealment mechanism. A malicious symlink sitting inside a cloned repository is indistinguishable from a legitimate one at a glance. The attack requires no elevated privileges, no exploit of an application vulnerability, and no social engineering beyond what a convincing README already provides. The file system does exactly what it is designed to do — and that is the problem.

The Approval Box That Shows You the Wrong File

Symlink redirection is not new. What makes GhostApproval distinct is that the attack neutralizes the one safeguard most developers assume is protecting them — the approval dialog that asks permission before a file is changed.

During testing of Claude Code, Wiz found the agent had already identified the real destination in its own internal reasoning, noting that project_settings.json was "actually a zsh configuration file." Despite that awareness, the approval box shown to the developer listed only the harmless-looking filename. The developer clicks Accept believing they are editing a local config. The write lands on their shell startup file or SSH keys.

Wiz describes this as an informed-consent bypass: the human remains in the loop, but the loop is feeding them false information.

Two tools in the study skip the approval step entirely. Windsurf writes the file to disk before the Accept and Reject buttons appear, meaning the prompt functions only as an undo option after the fact. Augment displays no dialog at all. Wiz demonstrated Augment silently reading an AWS credential file stored outside the project directory.

Patch Status Across Affected Tools

Among the six tools examined, the patch status as of publication breaks down as follows:

• Amazon Q Developer addressed the issue in Language Server version 1.69.0 under CVE-2026-12958, and the update installs automatically for most users.
• Cursor fixed the flaw in version 3.0 under CVE-2026-50549.
• Google Antigravity issued a fix with a CVE pending.
• Augment and Windsurf have acknowledged the problem but have not yet released patches.
• Anthropic disputes the classification, arguing the scenario falls outside its threat model because the developer chose to trust the folder at session start and then approved the edit.

Anthropic added that Claude Code's symlink warning shipped in early February — before Wiz's private report — as routine hardening rather than a reactive fix. The company also clarified that an earlier "no comment" response to Wiz was an automated reply rather than an intentional statement.

A Shared Design Weakness Across the Industry

GhostApproval does not appear to be an isolated discovery. In May 2026, Adversa AI published research on a nearly identical pattern called SymJack, identifying the same symlink-and-approval flaw across six coding agents including Claude Code, Cursor, GitHub Copilot, and Grok Build. Cursor's own advisory for its symlink vulnerability credits both Wiz and Cato AI Labs, whose earlier work The Hacker News covered under the name DuneSlide.

Two independent research teams reaching the same conclusion points to a structural problem in how these agents handle file operations — they follow a symlink using standard file system calls and then request approval based on the path they were handed, not the path where the write actually lands.

The broader pattern is already appearing beyond controlled research. As The Hacker News reported in June, the Miasma worm planted AI agent configuration files inside a Microsoft Azure repository so that its payload executed the moment a developer opened the project in Claude Code, Cursor, or Gemini. GitHub disabled 73 affected Microsoft repositories in response.

AWS's security bulletin also covers a separate Amazon Q flaw, CVE-2026-12957, in which a poisoned repository could auto-load a configuration file and run commands to steal a developer's AWS credentials once the workspace was trusted.

What This Means for the Wider Security Landscape

The convergence of findings from multiple independent research teams is significant. When separate groups working without coordination arrive at the same structural flaw, it suggests the problem is not incidental — it is baked into how an entire category of software was designed. AI coding agents were built to be capable and autonomous. The security architecture, in many cases, has not kept pace with that capability.

The intersection of AI and cybersecurity is increasingly where the most consequential vulnerabilities are emerging, and GhostApproval is a clear example of that trend. As these tools become embedded in enterprise development workflows, the attack surface they introduce grows proportionally.

For a broader perspective on why protecting these systems matters at an organisational level, understanding why cybersecurity is important for every business provides essential context — particularly as AI agents are granted deeper access to production systems, credentials, and infrastructure.

Guidance for Tool Makers and Developers

Wiz's guidance to tool makers is direct: resolve the symlink and display the real destination path before prompting for approval, flag any write operation that targets a location outside the project folder, and never touch the disk until the user has explicitly confirmed. These are not complex engineering changes — they are deliberate design choices that vendors must now treat as baseline requirements rather than optional hardening.

For additional context, the OWASP Top 10 for LLM Applications provides a widely referenced framework for understanding the vulnerability categories most relevant to AI-integrated development tools, including insecure output handling and prompt injection — both of which intersect with the mechanics of GhostApproval.

For developers using any of these tools today, a few practical steps reduce exposure regardless of whether a patch is available:

• Avoid pointing an agent at repositories from unfamiliar sources.
• Review a project's README and hidden configuration files before instructing an agent to execute setup tasks.
• Run agents inside a sandbox or container with limited file system access where possible.
• After working in an unfamiliar repository, check the timestamps on the files this attack targets — ~/.zshrc and ~/.ssh/authorized_keys — using a command such as ls -la ~/.zshrc ~/.ssh/authorized_keys to confirm nothing changed while the agent was active.

These files sit outside the project directory and will not appear in a standard git status output, making them easy to overlook. That invisibility is not a coincidence — it is what the attack depends on.

The Consent Problem Is Bigger Than One Bug

The deepest issue GhostApproval surfaces is not technical. It is epistemic. Developers have been encouraged to keep humans in the loop as a safeguard against autonomous AI action gone wrong. That principle is sound. But it only holds if the information presented to the human at the moment of decision is accurate. An approval prompt that names the wrong file is not a safeguard. It is a vulnerability wearing one.

The security of AI coding agents now depends not only on what they can do but on what they tell you they are doing. Until the approval dialog reflects reality — showing the resolved destination of every write operation, not the path the agent was handed — that dialog is theatre, not protection.