Symlinks committed to Git repos can silently redirect file reads and writes to arbitrary locations on a developer's machine. When an AI coding assistant is asked to 'set up' a cloned repo, it may follow a symlink disguised as an innocent config file and write an attacker's SSH key into ~/.ssh/authorized_keys — without the user realizing the real target. Wiz Research's GhostApproval report found this flaw in all six major AI coding assistants tested (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf). The attack chains three weaknesses: prompt injection via README instructions, symlink following without path resolution, and UI misrepresentation in approval dialogs. The fix is well-known: resolve every path to its canonical location before opening it, enforce workspace boundaries atomically (e.g., Linux's openat2() with RESOLVE_BENEATH), and always show users the real resolved path in confirmation dialogs. Developers can audit a fresh clone with `find . -type l` or `git ls-files -s` to spot symlinks before pointing any tool at the repo.
