GhostApproval Flaw Lets Malicious Repos Hijack AI Coding Agents

Security researchers at Wiz have disclosed a vulnerability class dubbed GhostApproval that affects six widely used AI coding assistants: Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The flaw exploits symbolic links, a Unix feature that allows a file to point to another file on disk. By embedding a malicious symlink inside a repository that masquerades as a benign configuration file, an attacker can redirect the assistant's write operations to sensitive targets such as ~/.ssh/authorized_keys or ~/.zshrc. The agent is instructed via the project's README to add a line to the seemingly innocent file, and the attacker receives passwordless SSH access or arbitrary code execution the next time the victim opens a terminal. Developers concerned about credential exposure can run their keys through a password checker to assess strength, while those verifying their SSH service exposure should consider a port scanner to confirm whether SSH ports are accessible from the internet.

The deeper issue is not the symlink itself but the approval dialog. In testing Claude Code, Wiz observed that the agent had internally recognized the symlink's true target, yet the consent prompt displayed only the harmless filename. The developer clicks Accept believing they are editing a local project setting, while the write actually lands in their shell startup file or SSH authorized_keys file. Windsurf compounds the problem by writing to disk before the Accept and Reject buttons render, reducing the dialog to a retroactive undo rather than a real gate. Augment is the most exposed of the six: it shows no approval dialog at all, and Wiz demonstrated it silently reading an AWS credential file located outside the project root.

As of publication, three of the six vendors have shipped patches, two have not responded with fixes, and Anthropic disputes that the behavior constitutes a bug. There is no evidence the technique has been used in real-world attacks, and Wiz has framed the disclosure as research. Until patches are universally deployed, developers should treat AI coding agents like any other process with filesystem write access: run them with least-privilege accounts, keep SSH key files and shell rc files outside workspace directories, and audit repository contents for symlinks before allowing an assistant to execute setup instructions. Teams managing cloud credentials that could be silently read should also run a breach exposure check to identify any tokens that may already be at risk.