--- title: GhostApproval bug breaks 6 top AI coding agents | daily.dev description: Security firm Wiz disclosed a vulnerability called GhostApproval affecting six major AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google... canonical: https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostApproval bug breaks 6 top AI coding agents | daily.dev og:description: Security firm Wiz disclosed a vulnerability called GhostApproval affecting six major AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google... og:url: https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov og:image: https://api.daily.dev/og/posts/lS2QV4toV.png og:image:alt: GhostApproval bug breaks 6 top AI coding agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostApproval bug breaks 6 top AI coding agents **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 1 upvotes · 0 comments ## Summary Security firm Wiz disclosed a vulnerability called GhostApproval affecting six major AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack uses an old Unix symlink trick inside a poisoned repository to make agents write outside their workspace — for example, injecting an attacker-controlled SSH key into the developer's real SSH keys file. A key finding is that confirmation dialogs in these tools hide the real symlink target, showing only the harmless filename, making user approval meaningless. Amazon, Cursor, and Google patched the issue; Augment and Windsurf acknowledged it but hadn't shipped fixes at press time. Anthropic disputed the severity, claiming the scenario is outside their threat model and that Claude Code already shipped a symlink warning before Wiz's report. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostApproval vulnerability in AI coding agents? GhostApproval is a symlink-based flaw disclosed by Wiz that affects six AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A poisoned repository disguises a malicious symlink as an innocent config file; when an agent is told to set up the workspace, it writes attacker-controlled SSH keys into the real keys file, giving the attacker passwordless machine access. _Track fixes for agent tools like Claude Code and Cursor as they roll out on daily.dev._ ### Which AI coding agents have patched the GhostApproval symlink flaw? Amazon, Cursor, and Google have patched it: Amazon issued a CVE and fixed Q Developer, Cursor patched it in version 3.0, and Google fixed Antigravity in May. Augment and Windsurf called the issue critical but had not shipped a fix at the time of reporting. Anthropic disputed the severity, saying Claude Code's scenario falls outside its threat model. _Developers weighing which coding agent to trust can follow patch status updates on daily.dev._ ### Why did Anthropic refuse to treat the Claude Code symlink issue as a vulnerability? Anthropic called the scenario 'outside our threat model' because the user had already trusted the directory being opened, and its triage system closed the ticket as 'informative.' Anthropic later said its own fix, a symlink warning shipped February 5, predated Wiz's report by nine days, framing it as proactive hardening rather than a response to the disclosure. _Anyone deciding how much to trust an agent's approval prompts can follow this debate on daily.dev._ ## Similar posts on daily.dev - [Bug in top AI coding agents shows that Unix-era security headaches never really die](https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1) · The Register · 1 upvotes · 0 comments - [GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools](https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu) · DevOps.com · 2 upvotes · 1 comments - [AI coding tool hole illustrates a big problem with human in the loop](https://daily.dev/posts/ai-coding-tool-hole-illustrates-a-big-problem-with-human-in-the-loop-kihdn3zbn) · CSO Online · 0 upvotes · 0 comments - [Symlinks Are Still Scary — And Yes, Git Supports Them](https://daily.dev/posts/symlinks-are-still-scary-and-yes-git-supports-them-lpppux8vz) · Snyk · 0 upvotes · 0 comments - [AI Security Incident Case: Ghostcommit Attack Leveraged Images to Steal Secrets](https://daily.dev/posts/ai-security-incident-case-ghostcommit-attack-leveraged-images-to-steal-secrets-chcx3kwno) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GhostApproval bug breaks 6 top AI coding agents","url":"https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov"},"datePublished":"2026-07-08T16:57:06.497Z","dateModified":"2026-09-14T06:49:46.469Z","description":"Security firm Wiz disclosed a vulnerability called GhostApproval affecting six major AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87b78301738acef19b2a8ea8de6ea2db?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87b78301738acef19b2a8ea8de6ea2db?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"GhostApproval bug breaks 6 top AI coding agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov#faq","mainEntity":[{"@type":"Question","name":"What is the GhostApproval vulnerability in AI coding agents?","acceptedAnswer":{"@type":"Answer","text":"GhostApproval is a symlink-based flaw disclosed by Wiz that affects six AI coding agents: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A poisoned repository disguises a malicious symlink as an innocent config file; when an agent is told to set up the workspace, it writes attacker-controlled SSH keys into the real keys file, giving the attacker passwordless machine access. Track fixes for agent tools like Claude Code and Cursor as they roll out on daily.dev."}},{"@type":"Question","name":"Which AI coding agents have patched the GhostApproval symlink flaw?","acceptedAnswer":{"@type":"Answer","text":"Amazon, Cursor, and Google have patched it: Amazon issued a CVE and fixed Q Developer, Cursor patched it in version 3.0, and Google fixed Antigravity in May. Augment and Windsurf called the issue critical but had not shipped a fix at the time of reporting. Anthropic disputed the severity, saying Claude Code's scenario falls outside its threat model. Developers weighing which coding agent to trust can follow patch status updates on daily.dev."}},{"@type":"Question","name":"Why did Anthropic refuse to treat the Claude Code symlink issue as a vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Anthropic called the scenario 'outside our threat model' because the user had already trusted the directory being opened, and its triage system closed the ticket as 'informative.' Anthropic later said its own fix, a symlink warning shipped February 5, predated Wiz's report by nine days, framing it as proactive hardening rather than a response to the disclosure. Anyone deciding how much to trust an agent's approval prompts can follow this debate on daily.dev."}}]} ```