AI coding assistants are susceptible to a symbolic link manipulation technique that allows unauthorized writes to sensitive system files, including SSH keys. In a proof-of-concept attack, a malicious repository creates a symlink from a benign file, such as project_settings.json, to ~/.ssh/authorized_keys. When the agent is instructed to modify the benign file, it follows the symlink and writes an attacker’s SSH key into the authorized_keys file, resulting in persistent, passwordless access to the developer’s machine.
Disclosed by Wiz Research on July 8, 2026, the vulnerability, termed “GhostApproval,” affects Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The mechanism exploits CWE-61, the improper handling of symbolic links, to bypass file system sandboxes. The vulnerability is compounded by CWE-451, where UI misrepresentation occurs. In several instances, the agent’s internal reasoning identifies the sensitive target file, but the confirmation prompt presented to the user displays only the benign filename. For example, during testing, Claude Code’s internal reasoning explicitly noted:
I can see that project_settings.json is actually a zsh configuration file
This discrepancy allows the agent to execute actions that the user has not explicitly authorized. As the Wiz researchers noted:
The agent knew. The user didn’t. This transforms a sandbox bypass into an informed consent bypass
The implementation of these agents reveals significant variance in how they handle file system operations and user authorization. Augment exhibited the most severe behavior: it performed both read and write operations without any user confirmation. The agent read external AWS credentials via symlinks and displayed them directly in the chat interface. Furthermore, it silently wrote SSH keys to the disk with no Allow/Deny dialog and no Undo button. In one instance, the agent’s chat noted that “project_settings.json is actually a zsh configuration file,” yet it proceeded to write the malicious payload regardless of this internal identification.
Windsurf demonstrated a different failure mode, where the agent executed file modifications before the confirmation dialog was even presented to the user. The tool wrote the attacker’s SSH key to the authorized_keys file before the Accept/Reject buttons appeared in the UI. Consequently, the confirmation dialog functioned merely as an undo mechanism rather than a functional security gate. Similarly, Amazon Q exhibited pre-authorization behavior, writing to the filesystem before presenting an Undo option to the user.
Cursor and Google Antigravity presented issues related to path transparency. In the case of Cursor, the diff UI displayed the symlink path to the user. However, when the user clicked Accept, the backend followed the symlink and wrote to the resolved target. Google Antigravity displayed the symlink path in its permission dialog rather than the resolved canonical path, obscuring the true destination of the file operation.
AWS, Cursor, and Google addressed the vulnerability through software patches. Amazon Q (CVE-2026-12958) was updated in language server 1.69.0, Cursor (CVE-2026-50549) in v3.0, and Google Antigravity in v1.19.6. These vendors modified their agents to prevent actions on paths that deviate from user-perceived targets. Augment and Windsurf remained unpatched five months after the initial February 2026 disclosure.
Anthropic disputed the classification of the issue for Claude Code. The company stated:
This falls outside our current threat model. When the user first starts Claude Code in a directory, they must confirm that they trust the directory prior to starting the session.
Despite this position, Anthropic updated its software to resolve symlinks and provide user warnings, noting that a symlink warning was introduced in v2.1.32 on February 5, 2026.
The Wiz Research team, including Maor Dokhanian, Mika Maymon, Gal Nagli, Shaked Rotlevi, and Yaron Niddam, identified GhostApproval as a category-level design flaw rather than an isolated bug. The research indicates that AI coding tools were developed with an implicit trust in the workspace environment, failing to account for the manipulation of file system primitives. The disclosure timeline from February to July 2026 demonstrates a lack of industry consensus regarding AI agent security responsibilities. The persistence of these vulnerabilities highlights a systemic gap between agent-side file system operations and user-side visibility.