Researchers found that several major AI coding assistants can be tricked into editing sensitive files outside a project folder, which can let an attacker gain control of a developer’s machine. Wiz calls the issue pattern 'GhostApproval' and says Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf were affected; the attack abuses symbolic links (filesystem shortcuts) in malicious repositories so an agent follows README instructions and writes to targets such as ~/.ssh/authorized_keys. Amazon, Cursor, and Google reportedly fixed the issue, while Augment and Windsurf had not patched at publication and Anthropic reportedly treated it as outside its threat model.
Why it matters: Developers and enterprises using AI coding agents may be giving those tools a path to overwrite sensitive local files and open persistent access from a booby-trapped repository. Users should update affected tools, restrict agent permissions, and avoid letting coding agents automatically follow setup instructions from untrusted repositories.
Eduard Kovacs
2026.07.09
99% relevant
This article is a direct report on the same GhostApproval event, adding vendor response details: AWS, Google, and Cursor have patched; Anthropic says it added mitigations and does not classify the issue as a vulnerability; Augment and Windsurf had acknowledged reports but had not yet released fixes. It also reiterates the symlink-based attack path and the user-confirmation prompt weakness that can lead to remote code execution on developer machines.
2026.07.08
100% relevant
This article appears to be the first broad report establishing the GhostApproval vulnerability pattern across multiple AI coding agents, with concrete affected products, exploitation mechanics, and patch status.
← Back to all stories