Wiz researchers discovered a vulnerability pattern called 'GhostApproval' affecting at least six major AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The flaw exploits symlinks: an attacker creates a malicious repository where a symlink disguised as a config file points to a sensitive system file (e.g., ~/.ssh/authorized_keys). When a developer asks their AI agent to set up the workspace, the agent follows the symlink and writes attacker-controlled content to the sensitive file, granting persistent SSH access. Critically, the confirmation dialogs shown to users hide the true symlink target, making human-in-the-loop approval meaningless. Amazon, Cursor, and Google patched the issue and issued CVEs. Anthropic dismissed it as outside their threat model. Augment and Windsurf acknowledged the report but haven't patched it. The case highlights a broader debate about whether AI tools should protect users from deceptive workspaces or whether that responsibility falls on developers.
