Last week, Wiz Research published details on GhostApproval, a flaw that hits six AI coding assistants. The short version: the approval pop-up you see when your coding assistant asks to edit a file can lie.
Here is how it works. A malicious repository contains a symbolic link disguised as an innocent config file. When your AI agent follows the README and tries to edit that file, the symlink secretly points to something sensitive on your machine, like your ~/.ssh/authorized_keys file. The agent writes an attacker-supplied public key into it. The pop-up shows a harmless filename. You click approve. The attacker now has passwordless access to your machine.
The affected tools include Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Amazon, Google, and Cursor treated it as high or critical severity and shipped fixes. Amazon issued CVE-2026-12958, Cursor issued CVE-2026-50549, and Google patched Antigravity.
Augment and Windsurf acknowledged the report but have not patched. Anthropic took the most interesting position: it argued the flaw was outside its threat model because the user already trusted the directory, then later added a symlink warning in Claude Code v2.1.32.
The core problem is not the symlink. Unix systems have had symbolic links for decades. The problem is that AI coding assistants bypass the normal human-in-the-loop security model. Wiz researcher Maor Dokhanian put it well: the consent is formally present but substantively empty.
What You Should Do Right Now
If you use any of these tools at work or at home, take these steps:
- Update immediately. Apply the latest patches for Claude Code, Amazon Q, Cursor, and Google Antigravity. If you use Augment or Windsurf, treat them as potential risks until those vendors ship a fix.
- Inspect unfamiliar repos. Malicious instructions in a README are the trigger. Before asking your AI assistant to set up a new project, check whether it contains unexpected symlinks or instructions to edit files you did not expect.
- Harden SSH access. Use hardware keys or time-limited certificates instead of permanent authorised_keys entries. If an attacker does plant a key, the blast radius is smaller if that key expires quickly.
- Limit agent reach. Audit what cloud credentials, environment variables, and mounted secrets your coding assistant can access. The same symlink trick can target cloud metadata or local credential stores.
This is not a panic moment. It is a signal. AI coding assistants are becoming autonomous enough that old trust assumptions no longer hold. The tool should resolve symlinks before showing you an approval dialog. Until every vendor does that, the human in the loop needs to verify the actual target path, not just the filename.
GhostApproval is a reminder that AI did not invent new security flaws. It repackaged old ones at scale. The tool that speeds up your workflow can just as easily speed up an attacker. Verify the path, not the pop-up.
