TheModelDesk

Researchers from Wiz have identified a critical vulnerability named GhostApproval affecting six popular AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The flaw stems from inadequate validation of symbolic links (symlinks) within project repositories.

An attacker can exploit this by creating a malicious repository containing a symlink—for example, naming it project_settings.json—that actually points to sensitive system files like ~/.ssh/authorized_keys or ~/.zshrc. By providing instructions in a Readme file, the attacker can trick the AI agent into writing malicious data, such as an attacker's SSH key, into these protected files, thereby bypassing sandbox restrictions.

Investigation showed that human oversight is not always effective. Claude Code recognized that a file was a symlink in its internal reasoning but failed to disclose this to the user in the confirmation prompt. Other tools were even less cautious: Windsurf performs the write operation before asking for permission, while Augment provides no confirmation dialog at all.

Most affected vendors have released patches since the discovery in February 2026. While Amazon Q Developer, Google Antigravity, and Cursor have addressed the issue, Augment and Windsurf remain unpatched at this time.