--- title: GhostApproval Flaw Featuring Decades-Old Feature Found... description: Security researchers at Wiz discovered a vulnerability called 'GhostApproval' affecting six major AI coding agents — Claude Code, Amazon Q Developer, Google... canonical: https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools | daily.dev og:description: Security researchers at Wiz discovered a vulnerability called 'GhostApproval' affecting six major AI coding agents — Claude Code, Amazon Q Developer, Google... og:url: https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu og:image: https://api.daily.dev/og/posts/P5K7J9cPU.png og:image:alt: GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 2 upvotes · 1 comments ## Summary Security researchers at Wiz discovered a vulnerability called 'GhostApproval' affecting six major AI coding agents — Claude Code, Amazon Q Developer, Google Antigravity, Augment, Cursor, and Windsurf. The attack exploits Unix symbolic links (symlinks) to trick coding agents into writing to unintended files, potentially granting attackers persistent SSH access or remote code execution on a developer's machine. A malicious repository can cause the agent to write an attacker's SSH public key to the victim's authorized keys before the user is even prompted for confirmation. Even when confirmation dialogs exist, the UI may not reveal the true target path, rendering human-in-the-loop protections ineffective. Adversa AI independently discovered the same class of attack, calling it 'SymJacking.' AWS, Cursor, and Google have patched the issue; Augment and Windsurf have fixes in progress; Anthropic initially rejected the report but has since shipped a symlink warning. Researchers argue this is a category-level design flaw across the AI coding tool industry, not an isolated vendor mistake. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostApproval vulnerability in AI coding assistants like Claude Code and Cursor? GhostApproval is a symlink-based trust bypass discovered by Wiz that lets a malicious repository trick an AI coding agent into writing to sensitive files while the approval prompt shows a harmless filename. It affected Anthropic Claude Code, Amazon Q Developer, Google Antigravity, Augment, Cursor, and Windsurf; attackers could use it to write SSH keys into authorized_keys for persistent remote access. _Track fast-moving AI agent security disclosures like this one on daily.dev before they hit your stack._ ### Which AI coding tools have fixed the symlink hijacking (SymJacking) vulnerability? AWS, Cursor, and Google have already fixed the symlink hijacking issue reported by Wiz and Adversa AI, while Augment and Windsurf have fixes in progress. Anthropic initially said the issue fell outside its threat model for Claude Code, but confirmed that version 2.1.32, released in February, already warns users before writing to sensitive files. _Developers weighing which coding agent to trust can follow patch status updates like these on daily.dev._ ### How does the symlink attack trick an AI coding agent's approval prompt into approving a malicious file write? An attacker crafts a repository containing a symlink where a file path secretly points to a different target file. When the AI agent writes to what looks like an innocuous file (e.g., project_settings.json) shown in the confirmation dialog, it actually writes to the symlink's real target, such as authorized_keys, bypassing the human-in-the-loop approval since the UI never resolves or shows the true path. _Understanding attack techniques like symlink hijacking helps developers vet AI agent workflows on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@akashskypatel** · 0 upvotes > First there was vibecoding, now there is vibehacking. Vibeslopping is getting out of control ## Similar posts on daily.dev - [GhostApproval bug breaks 6 top AI coding agents](https://daily.dev/posts/ghostapproval-bug-breaks-6-top-ai-coding-agents-ls2qv4tov) · The Next Web · 1 upvotes · 0 comments - [Bug in top AI coding agents shows that Unix-era security headaches never really die](https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1) · The Register · 1 upvotes · 0 comments - [AI coding tool hole illustrates a big problem with human in the loop](https://daily.dev/posts/ai-coding-tool-hole-illustrates-a-big-problem-with-human-in-the-loop-kihdn3zbn) · CSO Online · 0 upvotes · 0 comments - [Symlinks Are Still Scary — And Yes, Git Supports Them](https://daily.dev/posts/symlinks-are-still-scary-and-yes-git-supports-them-lpppux8vz) · Snyk · 0 upvotes · 0 comments - [AI Security Incident Case: Ghostcommit Attack Leveraged Images to Steal Secrets](https://daily.dev/posts/ai-security-incident-case-ghostcommit-attack-leveraged-images-to-steal-secrets-chcx3kwno) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools","url":"https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu"},"datePublished":"2026-07-09T15:51:16.944Z","dateModified":"2026-09-14T08:43:54.471Z","description":"Security researchers at Wiz discovered a vulnerability called 'GhostApproval' affecting six major AI coding agents — Claude Code, Amazon Q Developer, Google...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42744bc8da520afcf53e6f0e12af4103?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42744bc8da520afcf53e6f0e12af4103?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,ai-coding,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu","comment":[{"@type":"Comment","text":"First there was vibecoding, now there is vibehacking. Vibeslopping is getting out of control","datePublished":"2026-07-10T17:34:21.293Z","url":"https://daily.dev/posts/P5K7J9cPU#c-GDJ9mmAUv","author":{"@type":"Person","name":"Akash","url":"https://daily.dev/akashskypatel","image":"https://avatars.githubusercontent.com/u/8129618?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostapproval-flaw-featuring-decades-old-feature-found-in-six-ai-coding-tools-p5k7j9cpu#faq","mainEntity":[{"@type":"Question","name":"What is the GhostApproval vulnerability in AI coding assistants like Claude Code and Cursor?","acceptedAnswer":{"@type":"Answer","text":"GhostApproval is a symlink-based trust bypass discovered by Wiz that lets a malicious repository trick an AI coding agent into writing to sensitive files while the approval prompt shows a harmless filename. It affected Anthropic Claude Code, Amazon Q Developer, Google Antigravity, Augment, Cursor, and Windsurf; attackers could use it to write SSH keys into authorized_keys for persistent remote access. Track fast-moving AI agent security disclosures like this one on daily.dev before they hit your stack."}},{"@type":"Question","name":"Which AI coding tools have fixed the symlink hijacking (SymJacking) vulnerability?","acceptedAnswer":{"@type":"Answer","text":"AWS, Cursor, and Google have already fixed the symlink hijacking issue reported by Wiz and Adversa AI, while Augment and Windsurf have fixes in progress. Anthropic initially said the issue fell outside its threat model for Claude Code, but confirmed that version 2.1.32, released in February, already warns users before writing to sensitive files. Developers weighing which coding agent to trust can follow patch status updates like these on daily.dev."}},{"@type":"Question","name":"How does the symlink attack trick an AI coding agent's approval prompt into approving a malicious file write?","acceptedAnswer":{"@type":"Answer","text":"An attacker crafts a repository containing a symlink where a file path secretly points to a different target file. When the AI agent writes to what looks like an innocuous file (e.g., project_settings.json) shown in the confirmation dialog, it actually writes to the symlink's real target, such as authorized_keys, bypassing the human-in-the-loop approval since the UI never resolves or shows the true path. Understanding attack techniques like symlink hijacking helps developers vet AI agent workflows on daily.dev."}}]} ```