← Back to feed

The attack fits in a sentence: clone a repository, ask the AI assistant to set it up, and the assistant writes an attacker-controlled SSH public key to ~/.ssh/authorized_keys. No zero-day, no jailbreak. A symlink pointing outside the workspace, disguised as project_settings.json. The agent follows it. The developer approves a dialog showing the wrong file.

Wiz Research named the pattern GhostApproval and demonstrated it across six of the most widely deployed AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The disclosure landed July 8.

The Two-Layer Failure

The symlink vulnerability itself — CWE-61 — is decades old. What makes GhostApproval notable is the second layer on top of it. In several tools, the agent’s internal reasoning explicitly identified the dangerous target, then the confirmation dialog hidden it from the user.

The clearest case was Claude Code. In Wiz’s testing, Claude’s internal chain-of-thought stated: “I can see that project_settings.json is actually a zsh configuration file.” The dialog shown to the user read: “Make this edit to project_settings.json?”

The agent knew. The user did not. This is CWE-451 — UI misrepresentation of critical information — stacked on top of the symlink bypass. The human-in-the-loop became a rubber stamp.

Vendor Responses

Responses split cleanly across three camps.

Amazon classified the flaw as high-severity pre-authorization behavior in Q Developer — the agent wrote to the filesystem before presenting an Undo option — and shipped a fix in language server 1.69.0 alongside CVE-2026-12958.

Cursor issued CVE-2026-50549 and patched in v3.0.

Google treated it as critical in Antigravity and deployed a fix on May 22, with CVE assessment ongoing.

Augment and Windsurf acknowledged the reports and classified the issue as critical. Neither has shipped a patch as of July 15.

Anthropic’s initial response was that the scenario “falls outside our current threat model.” The company pointed to the requirement for users to confirm directory trust before starting a session. Current Claude Code versions (2.1.173+) resolve symlinks and warn before writing to sensitive files, but Anthropic told Wiz the fix shipped on February 5 — nine days before Wiz’s report — as part of internal proactive hardening, not in response to the disclosure.

Augment: Silent Read and Write, No Consent

Augment showed a more severe variant. The agent followed symlinks for both read and write operations with no confirmation dialog at all. Wiz demonstrated exfiltration of AWS credentials via a symlinked config file and SSH key injection via a symlinked ~/.zshrc — in each case, the agent’s chat log explicitly noted it was modifying a sensitive file, then proceeded.

Windsurf’s confirmation dialog was an undo mechanism, not an authorization gate. The agent wrote to disk before the accept/reject buttons appeared. By the time a user saw the prompt, the attacker’s SSH key was already in authorized_keys.

The Trust-Boundary Question

Augment’s position is that no patch can separate a coding agent’s ability to write from its ability to access the filesystem. “Developers need to think about what code they ask their agents to work with, the same way they think about what code they run themselves.” That shared-responsibility framing makes sense for cases where the developer reviews what the agent is doing. It breaks down when the dialog shows a different path from the one being written.

Wiz’s fix recommendations: resolve symlinks before presenting confirmation prompts, and flag any write whose canonical path lands outside the project directory. Amazon, Google, and Cursor implemented this. Two tools have not.

Augment and Windsurf users should treat any repository they did not author as a potential attack surface until patches arrive.