Ghost Approval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

Summary: Researchers at Wiz found a flaw they call GhostApproval in six AI coding assistants - Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf - where a malicious repository uses a symlink to make an approved edit land on a sensitive file instead, such as ~/.ssh/authorized_keys or ~/.zshrc. Wiz published the research on July 8; three of the six vendors shipped fixes, two are working on them, and Anthropic disputes it is a bug, saying the scenario sits outside its threat model.
What you should know: Windsurf writes the file to disk before the Accept and Reject buttons appear, and Augment shows no dialog at all, so in those tools the approval step offers no chance to intervene. Wiz's test of Claude Code found the agent's own reasoning identified project_settings.json as "actually a zsh configuration file" while the approval box named only the harmless file - the human stays in the loop, but the loop shows them the wrong thing.

Read the original at The Hacker News ↗