--- title: Bug in top AI coding agents shows that Unix-era security... description: Wiz researchers discovered a vulnerability pattern called 'GhostApproval' affecting at least six major AI coding assistants — Amazon Q Developer, Claude Code,... canonical: https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bug in top AI coding agents shows that Unix-era security headaches never really die | daily.dev og:description: Wiz researchers discovered a vulnerability pattern called 'GhostApproval' affecting at least six major AI coding assistants — Amazon Q Developer, Claude Code,... og:url: https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1 og:image: https://api.daily.dev/og/posts/K9D9JIsC1.png og:image:alt: Bug in top AI coding agents shows that Unix-era security headaches never really die og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bug in top AI coding agents shows that Unix-era security headaches never really die **[The Register](https://daily.dev/sources/theregister)** · 7 min read · 1 upvotes · 0 comments ## Summary Wiz researchers discovered a vulnerability pattern called 'GhostApproval' affecting at least six major AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The flaw exploits symlinks: an attacker creates a malicious repository where a symlink disguised as a config file points to a sensitive system file (e.g., ~/.ssh/authorized_keys). When a developer asks their AI agent to set up the workspace, the agent follows the symlink and writes attacker-controlled content to the sensitive file, granting persistent SSH access. Critically, the confirmation dialogs shown to users hide the true symlink target, making human-in-the-loop approval meaningless. Amazon, Cursor, and Google patched the issue and issued CVEs. Anthropic dismissed it as outside their threat model. Augment and Windsurf acknowledged the report but haven't patched it. The case highlights a broader debate about whether AI tools should protect users from deceptive workspaces or whether that responsibility falls on developers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostApproval vulnerability in AI coding agents? GhostApproval is a symlink-based attack pattern discovered by Wiz affecting AI coding agents like Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repo disguises a symlink as a config file; when the agent follows README instructions to edit it, it writes attacker-controlled data (like an SSH key) to a sensitive file such as ~/.ssh/authorized_keys, while the confirmation dialog hides the true target from the user. _Developers running AI coding agents on untrusted repos can track vulnerability disclosures like this on daily.dev._ ### Did Cursor fix the GhostApproval symlink vulnerability and what CVE was assigned? Yes, Cursor fixed the GhostApproval flaw in its v3.0 update and issued CVE-2026-50549 to track it. Amazon similarly classified its version of the bug as a high-severity pre-authorization write issue in Q Developer, assigned CVE-2026-12958, and shipped a fix. Google deemed it critical in Antigravity and deployed a fix on May 22, though a CVE tracker had not yet been finalized. _Teams deciding whether to trust an AI coding tool's patch cadence can follow CVE disclosures on daily.dev._ ### Why did Anthropic refuse to treat the Claude Code symlink issue as a vulnerability? Anthropic classified the GhostApproval report as outside its threat model, arguing that users must confirm they trust a directory before starting a Claude Code session, so a malicious symlink inside an already-trusted directory falls on the user, not the tool. Anthropic closed the Wiz-submitted ticket as 'informative' without confirming whether later fixes in Claude versions 2.1.173+, which resolve symlinks and warn before sensitive writes, were related to the report. _Anyone weighing AI coding agents' differing security postures can compare vendor responses on daily.dev._ ## Similar posts on daily.dev - [GhostApproval bug breaks 6 top AI coding agents](https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov) · The Next Web · 1 upvotes · 0 comments - [GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools](https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu) · DevOps.com · 2 upvotes · 1 comments - [AI coding tool hole illustrates a big problem with human in the loop](https://daily.dev/posts/ai-coding-tool-hole-illustrates-a-big-problem-with-human-in-the-loop-kihdn3zbn) · CSO Online · 0 upvotes · 0 comments - [Symlinks Are Still Scary — And Yes, Git Supports Them](https://daily.dev/posts/symlinks-are-still-scary-and-yes-git-supports-them-lpppux8vz) · Snyk · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bug in top AI coding agents shows that Unix-era security headaches never really die","url":"https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1"},"datePublished":"2026-07-08T14:01:38.117Z","dateModified":"2026-09-14T07:49:22.551Z","description":"Wiz researchers discovered a vulnerability pattern called 'GhostApproval' affecting at least six major AI coding assistants — Amazon Q Developer, Claude Code,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b7cbf6381ac1109e11ba48405c293d0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b7cbf6381ac1109e11ba48405c293d0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Bug in top AI coding agents shows that Unix-era security headaches never really die"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1#faq","mainEntity":[{"@type":"Question","name":"What is the GhostApproval vulnerability in AI coding agents?","acceptedAnswer":{"@type":"Answer","text":"GhostApproval is a symlink-based attack pattern discovered by Wiz affecting AI coding agents like Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repo disguises a symlink as a config file; when the agent follows README instructions to edit it, it writes attacker-controlled data (like an SSH key) to a sensitive file such as ~/.ssh/authorized_keys, while the confirmation dialog hides the true target from the user. Developers running AI coding agents on untrusted repos can track vulnerability disclosures like this on daily.dev."}},{"@type":"Question","name":"Did Cursor fix the GhostApproval symlink vulnerability and what CVE was assigned?","acceptedAnswer":{"@type":"Answer","text":"Yes, Cursor fixed the GhostApproval flaw in its v3.0 update and issued CVE-2026-50549 to track it. Amazon similarly classified its version of the bug as a high-severity pre-authorization write issue in Q Developer, assigned CVE-2026-12958, and shipped a fix. Google deemed it critical in Antigravity and deployed a fix on May 22, though a CVE tracker had not yet been finalized. Teams deciding whether to trust an AI coding tool's patch cadence can follow CVE disclosures on daily.dev."}},{"@type":"Question","name":"Why did Anthropic refuse to treat the Claude Code symlink issue as a vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Anthropic classified the GhostApproval report as outside its threat model, arguing that users must confirm they trust a directory before starting a Claude Code session, so a malicious symlink inside an already-trusted directory falls on the user, not the tool. Anthropic closed the Wiz-submitted ticket as 'informative' without confirming whether later fixes in Claude versions 2.1.173+, which resolve symlinks and warn before sensitive writes, were related to the report. Anyone weighing AI coding agents' differing security postures can compare vendor responses on daily.dev."}}]} ```