GhostApproval Symlink Flaw Enables Remote Code Execution via AI Coding Assistants
Researchers at Wiz discovered a vulnerability pattern called GhostApproval affecting six popular AI coding assistants, where malicious code repositories can use symlinks to trick the tools into writing to sensitive files outside their intended workspace. The flaw exploits a mismatch between what the AI agent recognizes as dangerous and what confirmation prompts show to developers, potentially enabling remote code execution on developer machines.
What happened
Researchers at Wiz discovered GhostApproval, a vulnerability pattern affecting six AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Malicious code repositories can exploit symlinks to trick the tools into writing to sensitive files outside their intended workspace sandbox.
In each case, the agent's internal reasoning recognizes the dangerous target, but the confirmation prompt shown to the user conceals this information. The user approves what they believe is a harmless local edit while the agent writes to a sensitive file outside the project workspace, potentially achieving remote code execution on the developer's machine.
Reported impact
The vulnerability allows attackers to escape the sandbox protections designed into these tools and gain unauthorized access to arbitrary files outside the workspace.
Index analysis
Symbolic links are special files that act as shortcuts to other files or directories and have been used as attack vectors for decades. GhostApproval exploits this well-known technique by combining it with UI misrepresentation of critical information (CWE-451), where the confirmation prompt does not accurately reflect the file that will be modified.
Governance controls
Wiz reported the issue to the six affected vendors. AWS, Cursor, and Google fixed the issue promptly, Augment and Windsurf acknowledged receipt but went silent, and Anthropic had already fixed the problem before being contacted by Wiz.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.