GhostApproval: Six AI Coding Assistants Asked Permission and Named the Wrong File

On 8 July 2026 the security firm Wiz published GhostApproval, a research finding in which a symbolic link planted in a repository made six AI coding assistants write outside their workspace — into ~/.ssh/authorized_keys, which grants persistent password-less SSH access, or into ~/.zshrc, which runs at the next shell start — while the confirmation dialog named only the harmless file the link was pretending to be. Wiz tested Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf, and reported the pattern in all six. No exploitation in the wild has been reported: the work is a proof-of-concept demonstration, and the archive entry records no real harm. Three vendors shipped fixes, two acknowledged the report and then stopped replying, and one disputed that the behaviour was a vulnerability at all. The Orca AI Incident Archive holds the full record for this finding alongside the other entries filed under its SANDBOX type tag.

The primitive itself is old news. Symlink following, catalogued as CWE-61, has been an attack primitive for decades — Wiz lists earlier uses in race conditions, package managers and container escapes — and every one of those depended on a tool writing to a user-controlled path without resolving it first. What made this finding worth a name is the second layer: in several products the assistant's own reasoning identified the dangerous destination, and the prompt shown to the human hid it. Wiz files that as CWE-451, user-interface misrepresentation of critical information. The security boundary was present. The information a person needed to exercise it was not.

How the trick works, and what it lands on

Wiz's malicious repository is deliberately boring. It contains a symlink named project_settings.json that resolves to the developer's SSH authorised-keys file, plus a README instructing the agent to update that "config" while setting up the workspace. When the developer asks the assistant to follow the README, the agent follows the link and writes the attacker's public key. If the machine runs an SSH service the attacker can reach, that is password-less login from then on. A second variant points the same decoy at ~/.zshrc, so the payload executes the next time a terminal opens and no SSH access is needed at all.

Wiz's description of the technical failure is short: the sandbox, where one exists, does not validate the canonical path, so a write aimed inside the project lands wherever the link points. The firm's proof of concept reproduced this across "6 of the top AI coding assistants", in its own words, and it published screenshots for each. The affected population is anyone who opens a repository they did not author in one of those tools — which, in normal developer workflow, includes forked projects, third-party dependencies and any code review of an outside contributor's branch.

The dialog that named the wrong file

The clearest evidence came from Claude Code. In Wiz's test the agent's reasoning stated, in the firm's quotation, "I can see that project_settings.json is actually a zsh configuration file." The permission prompt the user saw asked: "Make this edit to project_settings.json?" The agent knew where the write was going; the person authorising it did not. Wiz calls the resulting consent "substantively empty" and the human-in-the-loop check a rubber stamp.

Three products made the gap worse than a bad label. Windsurf wrote the file to disk before the Accept and Reject buttons appeared, so the dialog was an undo offer rather than an authorisation gate — by the time a user could decline, Wiz says, the key was already in place. Amazon Q Developer showed the same ordering, offering only an Undo button after the write. Augment asked nothing at all: Wiz demonstrated a symlinked read that surfaced a decoy AWS credentials file from outside the project in the chat transcript, and a symlinked write to ~/.ssh/authorized_keys with no dialog of any kind. At the other end, Cursor and Google Antigravity displayed the unresolved path and asked for a click that authorised the resolved one.

Wiz's first test ran on 10 February 2026 and the reports went out between 12 February and 5 March. Its disclosure timeline records the acknowledgements: Anthropic on 15 February, Augment on 24 February, Google on 26 February, Cursor on 2 March, AWS on 6 March and Cognition, which owns Windsurf, on 23 June. Public disclosure followed roughly five months after the first report.

Six vendors, three answers

Wiz rates the findings by its own severity scale, from High at AWS to Critical at Augment, Cursor, Google Antigravity and Windsurf. Three vendors treated the report as a vulnerability and shipped a fix. The archive grades the entry high severity and A on confidence, and the primary advisories agree with Wiz on the mechanism.

• Amazon Web Services. High severity, tracked as CVE-2026-12958 and fixed in Language Servers for AWS 1.69.0. AWS's own bulletin 2026-047-AWS, published 23 June 2026, confirms "a missing symlink-validation issue" before 1.69.0 and lists the minimum plugin builds that carry the fix: Amazon Q Developer for Visual Studio Code 2.20, for JetBrains 4.3, for Eclipse 2.7.4, and AWS Toolkit with Amazon Q for Visual Studio 1.94.0.0. It states there are no workarounds, that the language server updates automatically unless a network configuration prevents it, and thanks Wiz for the coordinated disclosure. The CNA record scores the issue 8.5 under CVSS 4.0 and 7.8 under CVSS 3.1.

• Cursor. Critical, tracked as CVE-2026-50549 and fixed in Cursor 3.0. The record was published by GitHub as CNA on 25 June 2026 at 9.3 under CVSS 4.0. Its description frames the attacker slightly differently from Wiz's repository story: a malicious agent creates an in-workspace symlink and forces path canonicalisation to fail, either because the target does not exist or because read permission was stripped from the path, after which the write falls back to the original path without approval and can overwrite the sandbox helper for unsandboxed execution.

• Google. Wiz rates Antigravity Critical and records the fix as version 1.19.6, deployed on 22 May 2026. Its severity column reads "Pending" and Google was, in Wiz's account, assessing whether to issue a CVE; no CVE identifier for Antigravity appears in the public record.

• Augment. Critical by Wiz's rating, tested on 0.754.3, acknowledged on 24 February 2026 and unpatched at publication. The Cloud Security Alliance's research note on the finding records Augment's counter-argument that an agent operates under the user's own credentials.

• Windsurf. Critical by Wiz's rating, tested on build V1.9566, acknowledged by Cognition on 23 June 2026 and unpatched at publication.

• Anthropic. Disputed. No CVE, and Claude Code's tested version, 2.1.42, sits in Wiz's table with the status "Rejected".

Anthropic's rejection, and the fix that predates the report

Anthropic's answer to Wiz was a considered no. "This falls outside our current threat model," the company wrote, according to Wiz's quotation. "When the user first starts Claude Code in a directory, they must confirm that they trust the directory prior to starting the session. The scenario you describe involves a user explicitly confirming a permission prompt inside of a directory containing a malicious symlink, which falls outside of the Claude Code threat model." The ticket was closed as "Informative".

That reasoning has a coherent shape: the user trusted the directory, then approved the operation, so both consent moments were respected. Wiz's rebuttal is that informed consent needs accurate information — approving project_settings.json while the write lands in ~/.ssh/authorized_keys is formally a decision and substantively an empty one. Wiz does not claim to have settled which position is right, and neither does this article. The practical observation is that AWS, Google and Cursor took the other view and patched.

Wiz also reported that Claude Code had changed underneath the dispute: current versions, the firm wrote, resolve symlinks and warn before writing to sensitive files, and it noted that Anthropic declined to say whether that was connected to the report. On 7 July 2026 Anthropic supplied a correction, quoted by Wiz: "The symlink warning in the Edit/Write permission dialog shipped in v2.1.32 (Feb 5, 2026), nine days before this report was submitted to us. It was added as part of proactive security hardening based on internal review. The decline to comment was an autoreply from our triage system."

The version timing checks out; the public record of what changed does not. Claude Code 2.1.32 was published to the npm registry on 5 February 2026 at 17:03 UTC, which is nine days before the 14 February report, exactly as Anthropic says. But the public changelog entry for that release lists twelve changes, including agent teams, memory recording and several UI fixes, and none of them mentions symlinks or permission dialogs. The first changelog lines that describe this exact behaviour are much later: version 2.1.280, published to npm on 22 September 2026, records "Fixed writes through a symlinked path being judged by their in-tree spelling: the prompt names where the write lands", and 2.1.287 on 1 October 2026 records that a shell write through a repository-committed symlink onto a sensitive file now names where it lands and waits for a person. Wiz's own observation that 2.1.173 and later resolve symlinks also lands after the report, since 2.1.173 shipped on 11 June 2026.

What is established, and what is not

• Established. The mechanism: a decoy symlink in a repository, an agent that follows it, a write that lands outside the workspace, and a confirmation surface that names the wrong path. Wiz reproduced it in all six products and published screenshots. Two CVE records exist and are published by their CNAs, and AWS's bulletin independently confirms the sub-1.69.0 hole and the fix. Anthropic does not dispute that the behaviour occurred; it disputes that it is a vulnerability.

• Single-sourced. The severity ratings for Augment, Windsurf and Google Antigravity are Wiz's judgments, not CNA scores, because no CVE was published for any of the three. The claim that Windsurf and Amazon Q write before the dialog appears rests on Wiz's screenshots and narration; no vendor has confirmed the ordering in public.

• Disputed. Whether a tool owes its user protection from a deceptive workspace, or whether directory trust plus a click settles the question. Anthropic says the latter; Wiz says the prompt it showed made the click meaningless. The archive does not flag the record as disputed: the facts are agreed and only the interpretation is contested.

• Not established. Whether Augment and Windsurf have fixed the flaw since publication. All the coverage reviewed for this piece, including the Cloud Security Alliance note of 15 July 2026, still describes both as unpatched; no public fix notice from either vendor was found.

The date itself carries a small wrinkle. Wiz's post and its disclosure timeline both give 8 July 2026, Infosecurity Magazine describes the proof of concept as published on 7 July and its own report on 9 July, and the archive entry is dated 9 July 2026 at day precision. The finding, the reporting and the archive do not disagree about the week; they disagree about the day by up to two.

Earlier work on one of the six deserves separate credit. CSO Online's Evan Schuman, writing on 9 July 2026, noted that Cato Networks had reported a Cursor-only version of the flaw before Wiz's wider study. SecurityWeek's account of that research, published 3 July 2026, names it DuneSlide, assigns CVE-2026-50548 and CVE-2026-50549 to the pair, scores both 9.8, and dates the Cursor 3.0 release that fixed them to 2 April — figures that do not line up with Wiz's timeline, which puts Cursor's fix publication on 5 June, or with the CNA record published on 25 June at 9.3. The 9.8 and the 9.3 are two scorers on the same flaw; the April and June dates may be describing a release and an advisory rather than disagreeing about when the patch shipped.

What changed afterwards

Concretely: Amazon Q Developer users were moved to language server 1.69.0, automatically in most configurations; Google Antigravity users to 1.19.6 from 22 May 2026; Cursor users to 3.0; and Claude Code users to a version that resolves links, with further prompt-fidelity changes landing in 2.1.280 and 2.1.287 during September and October 2026. Augment and Windsurf users, on the evidence available at publication, got a date to watch for and nothing else.

Wiz's own recommendations were narrow and technical: resolve symlinks before displaying a prompt, warn explicitly when the resolved path falls outside the workspace, and never write to disk before explicit authorisation, so the dialog is a gate rather than an undo button. The Cloud Security Alliance note adds governance framing — treat coding assistants as privileged software with filesystem access rather than as editor plugins, and ask vendors directly whether paths are resolved before a confirmation appears. IDC's Katie Norton, quoted by CSO Online, put the residual risk where the supply chain already runs: outside contributors, forked repositories and third-party dependencies, "rather than in internally authored code".

What remains open is the design question, not the bug. Six independently built products converged on the same sequence — show the requested path, trust the click — and the divergence afterwards was about liability, not about mechanism. The archive entry carries a landmark flag, which is the archive's judgment that the record describes a category rather than a single vendor's mistake, and it is hard to argue with that reading: the same short proof of concept worked six times.