To execute the GhostApproval attack, an attacker needs only a few commands. Create a directory, initialize a repository, and create a symbolic link: ln -s ~/.ssh/authorized_keys project_settings.json. Add a README file instructing an AI coding assistant to update the project settings. When the agent follows the symlink, it bypasses workspace boundaries to modify the user’s SSH keys. The proof-of-concept is trivial, yet it exposes a structural failure in how AI agents interact with local file systems.
Disclosed by Wiz Research on July 8, 2026, GhostApproval is a vulnerability pattern affecting six major AI coding assistants. It functions by layering two distinct security failures: CWE-61, which involves following symlinks outside of a restricted directory, and CWE-451, which covers the UI misrepresentation of critical information. Because the agent operates with the user’s system permissions, the write operation succeeds, often without the user realizing the target has been redirected.
The most significant aspect of this vulnerability is the CWE-451 layer. Wiz Research observed that AI agents often recognized the true nature of the target file during their internal reasoning process. In some instances, the agent explicitly noted, “I can see that project_settings.json is actually a zsh configuration file.” Despite this internal awareness, the confirmation prompt presented to the user displayed only the benign, original filename. The agent effectively hid the danger from the human operator.
The status of the affected vendors varies. Amazon Q Developer addressed the issue in Language Server 1.69.0 (CVE-2026-12958). Cursor released a fix in version 3.0 (CVE-2026-50549). Google Antigravity has implemented a fix, with a CVE pending. Anthropic’s Claude Code, which initially disputed the report, was assigned CVE-2026-39861 and has since been patched in version 2.1.64.
Anthropic was the sole vendor among the six to dispute the vulnerability, arguing that the issue fell outside their threat model because users must trust a directory before starting a session. However, this defense is undermined by their own timeline. Anthropic later clarified that they had shipped a symlink warning in their Edit/Write permission dialog on February 5, 2026 — nine days before the report was submitted. The company stated that the initial decline to comment was an autoreply from their triage system, but the existence of the preemptive fix suggests they recognized the risk internally while publicly dismissing the classification.
The situation remains more precarious for other tools. Both Augment and Windsurf have acknowledged the vulnerability but had not released fixes by the disclosure date. Augment is considered critical, as the tool performed both read and write operations following symlinks without any user confirmation dialog or undo mechanism. Windsurf is also classified as critical, as the agent writes modifications to the disk before the user is even presented with Accept or Reject buttons, rendering the confirmation dialog a post-hoc undo mechanism rather than a true authorization gate.
Wiz Research frames GhostApproval not as an isolated error, but as what they assess to be a category-level blind spot across the AI coding tool ecosystem. The vulnerability highlights a fundamental breakdown in the “Human-in-the-Loop” security model, which relies on the user making informed decisions based on the information provided by the agent. As Wiz Research notes, “The agent knew. The user didn’t. This transforms a sandbox bypass into an informed consent bypass — the user approves what they believe is a harmless local edit, while the agent modifies ~/.zshrc or ~/.ssh/authorized_keys.”
The discrepancy between the agent’s internal knowledge and the information presented to the user is the crux of the problem. As Wiz Research noted, “The Human-in-the-Loop security model only works if the loop provides accurate information. When an agent shows one thing and does another, user approval becomes meaningless.”
To mitigate these risks, Wiz recommends that developers of AI coding assistants implement three specific controls. First, agents must resolve all symlinks before displaying any prompts to the user. Second, the UI must explicitly warn the user if the resolved path of a file operation lies outside the designated project workspace. Finally, agents should never write to the disk before receiving explicit, informed user authorization.