Security firm Wiz disclosed on July 8, 2026, a vulnerability dubbed "GhostApproval" affecting six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — that lets a malicious repository read or write files outside the workspace.
July 8, 2026 · Security Disclosure
"GhostApproval": a hidden symlink turns AI's safety prompt against you
Six AI coding assistants can be tricked into writing to files outside the workspace. The approval dialog shows a harmless name like project_settings.json while a symlink quietly redirects the write to ~/.ssh/authorized_keys .
6
AI coding assistants affected
1
command is enough to inject an SSH key
0
confirmed real-world exploits
How the trust boundary breaks
1 · Clone repo
Malicious repo hides a planted symlink
→
2 · Ask AI
"Set up the workspace" per the README
→
3 · Fake consent
Dialog shows a safe filename
→
4 · Payload lands
Write follows symlink to ~/.ssh
The blind spot: the "Human-in-the-Loop" approval fails because the UI misrepresents the true write target — CWE-61 (symlink following) + CWE-451 (UI misrepresentation).
Vendor response · 6 products
4 fixed · 2 still in progress at disclosure
Amazon Q Developer
High · CVE-2026-12958 · Fixed
Cursor
Critical · CVE-2026-50549 · Fixed v3.0
Google Antigravity
Critical · Fixed (May 22)
Claude Code
v2.1.42 · Symlink resolution added
Augment
Critical · In progress
Windsurf
V1.9566 · In progress
A Unix-era headache reborn on AI agents
Symlink attacks first plagued package managers years ago (CVE-2018-15664). The same flaw now resurfaces in tools built on the Model Context Protocol.
Precondition
Clone a malicious repo + issue an instruction — not fully automatic.
The risk ahead
As enterprise AI-agent adoption accelerates, this MCP blind spot stays a concern.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…