Researchers Find New GhostApproval Bug in Many AI Coding Assistants

Security researchers have identified a new set of vulnerabilities that are present in many of the top AI coding assistants and allows malicious repositories to bypass workspace sandboxes and potentially achieve remote code execution on a user’s machine. 

The bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links. Symlinks are used as shortcuts in Unix and derivative systems as a way to use one file to point to another file or directory. Symlinks have plenty of legitimate uses, but attacks abusing them have been well-known for many years, and there are many examples of attack techniques and vulnerabilities that included symlinks. 

Popular AI Agents Affected

The new class of vulnerability, which Wiz is calling GhostApproval, stems from a convergence of the use of symlinks and modern AI design, specifically bypassing the intended "Human-in-the-Loop" safety controls. Researchers at Wiz found that six popular AI coding assistants–Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf–were susceptible to this issue and reported it to all of the affected vendors. AWS, Cursor, and Google have fixed the issue, while Augment and Windsurf acknowledged the researchers’ report but did not send further information. Anthropic acknowledged the issue but said it falls outside of the Claude Code threat model.

Wiz discovered this issue in February and disclosed it to the affected vendors over the next couple of weeks. By late June, AWS, Cursor, and Google had all released fixes. Both AWS and Cursor also assigned CVEs to the bug in their agents. The Wiz researchers tested the issue on macOS and Linux systems, but said it could also affect agents on Windows systems under some circumstances.

“If a user opens a maliciously crafted workspace containing a symlink that resides within the workspace but resolves to a location outside the workspace trust boundary, the agent may follow that symlink and write to the external location without prompting the user for approval. This can result in the modification of files outside the intended workspace boundary,” AWS said in its advisory for CVE-2026-12958.

“This issue is triggered when a user opens a workspace, trusts it, and the agent subsequently writes to a path within that workspace.”

Following Symlinks Considered Bad

The attack developed by the Wiz researchers relies on a combination of a symlink and a quirk in the coding agents’ UIs that hides the real target of the code that the agent is being asked to write. By crafting a malicious repository that contains a symlink disguised as a project configuration file (for example: project_settings.json) pointing to a sensitive system path like ~/.ssh/authorized_keys, an attacker can trick an autonomous agent into writing data to the target file outside the project's sandbox.

This has the effect of removing the informed human consent from the system. 

“The symlink primitive alone is serious, but what we found goes deeper. Many of these tools have sandboxes or confirmation dialogs designed to prevent exactly this kind of attack. The dialog intercepts the write and asks the user for permission. In theory, this is the Human-in-the-Loop safety net. The failure is not just that the symlink is followed – it's that the UI doesn't reveal the true target,” Maor Dokhanian of Wiz wrote in a post on the attack.

The researchers tested six popular AI coding assistants and found variations of the GhostApproval vulnerability in all of them. The severity varied by vendor:

• Pre-Authorization Writes: Some tools, such as Amazon Q and Windsurf, were found to write modifications to the filesystem before the user even had an opportunity to accept or reject the action.
• Silent Execution: Augment performed both file reads (exfiltrating sensitive data) and writes without any user confirmation dialog whatsoever.
• Deceptive UI: Tools such as Anthropic’s Claude Code and Google’s Antigravity prompted the user to approve edits while masking the true, sensitive target of the file operation.

As AI coding assistants have become a crucial part of developers’ everyday workflows in the last few years, the time-worn advice to not trust random code from the internet has become ever more important. 

While symlink-following is a known, legacy threat, the research highlights a more modern issue: misrepresenting information in the UI. In several cases, the AI agent’s internal reasoning explicitly acknowledges that it is accessing a sensitive configuration file, but the confirmation prompt presented to the user conceals this fact. This transforms the user's manual approval process into an informed consent bypass. The user believes they are approving a legitimate local edit, while the agent proceeds to write to system-level files.

“The Human-in-the-Loop security model only works if the loop provides accurate information. When an agent shows one thing and does another, user approval becomes meaningless. The confirmation dialog transforms from a security control into a formality,” Dokhanian said. “This is not a collection of individual bugs – it's a category-level design question that the AI coding industry hasn't fully addressed. As these tools race to ship autonomous features, the trust boundaries between user, agent, and filesystem need clearer definition.”