GhostApproval: symlinks in a malicious repo let AI coding assistants write outside the project, sometimes behind a misleading approval prompt

Research · Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf · HIGH

Incident dateNot stated

DisclosedJul 8, 2026 (Wiz). Earlier vendor records: Cursor GHSA-3v8f-48vw-3mjx Jun 5, 2026; CVE-2026-12958 and CVE-2026-50549 in NVD June 2026.

Added hereOct 16, 8:31 AM ET

Last verifiedOct 16, 2026

Summary

Wiz Research published GhostApproval on Jul 8, 2026. The trick is old but it works on agents: a repo ships a file that looks like ordinary project config but is really a symbolic link to something like ~/.ssh/authorized_keys or ~/.zshrc. Ask the assistant to set up the workspace or follow the README, and it writes through the link to the real file. Wiz tested Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf. In some, the approval prompt named the decoy file instead of the real target; in others the write landed before any prompt appeared. Most vendors have shipped changes. Cursor fixed it in 3.0 (CVE-2026-50549, CVSS 4.0 9.3), AWS in Language Servers for AWS 1.69.0 (CVE-2026-12958, CVSS 4.0 8.5), and Google deployed a fix on May 22, 2026. Devin Desktop (formerly Windsurf) 3.6.27, released Aug 1, 2026, makes its edit and write tools refuse to write through a symlink. Anthropic disputes that this is a Claude Code vulnerability and says a symlink warning shipped in Claude Code 2.1.32 on Feb 5, 2026, before Wiz's report; Wiz notes current versions (2.1.173 and later) resolve symlinks and warn before writing to sensitive files. We found no confirmed fix from Augment.

Severity

HIGH High (VibeIncidents editorial rating). Vendor scores range from High (AWS, CVSS 4.0 8.5) to Critical (Cursor, CVSS 4.0 9.3). The attack needs a malicious repository and a user who points the agent at it, and most vendors shipped changes months ago. No exploitation reported. Fair note: Anthropic does not consider this a Claude Code vulnerability, and we do not describe Claude Code as unpatched.

Timeline

Feb 5, 2026
Anthropic says Claude Code 2.1.32 added a symlink warning to the Edit/Write permission dialog.
Feb 14, 2026
Wiz reports the issue to Anthropic, which closes it as outside its threat model.
May 22, 2026
Google deploys a fix for Antigravity, per Wiz.
May 27, 2026
AWS deploys the fix in language server version 1.69.0, per Wiz.
Jun 5, 2026
Cursor publishes GHSA-3v8f-48vw-3mjx; fixed in 3.0.
Jul 8, 2026
Wiz publishes GhostApproval covering six assistants.
Aug 1, 2026
Devin Desktop 3.6.27 makes its edit and write tools refuse to write through a symlink.

How it happened

Symlink following (CWE-61), and in several tools an approval prompt that shows the link's in-repo name rather than where it actually points (CWE-451). Wiz's proof of concept is a repo with project_settings.json linked to ~/.ssh/authorized_keys and a README asking the agent to add an SSH key to it. Wiz says Amazon Q and Windsurf wrote to disk before the user could approve, Augment read and wrote through links with no prompt at all, and Cursor, Antigravity and Claude Code showed the decoy path. Cursor's own advisory describes a narrower fallback bug: when resolving the real path failed, the agent wrote to the original path without approval, so a link to a missing or unreadable target slipped past the workspace check. AWS's CVE describes missing symlink validation that allowed writes outside the workspace trust boundary. Anthropic told Wiz the scenario is outside Claude Code's threat model because the user has already trusted the directory and approved the prompt, and said the 2.1.32 warning was proactive hardening. Wiz tested Augment 0.754.3, Windsurf 1.9566, Claude Code 2.1.42 and Antigravity 1.19.6. Augment acknowledged the report; we found no confirmed fix.

How to check your app

Update Cursor to 3.0 or later.
Make sure Language Servers for AWS (Amazon Q Developer) is 1.69.0 or later. AWS says it auto-updates unless your network blocks it; reloading the IDE triggers the update.
Update Devin Desktop (Windsurf) to 3.6.27 or later, and keep Google Antigravity and Claude Code current.
Before letting an agent loose on an unfamiliar repo, list symlinks that point outside it: find . -type l -exec ls -l {} +
Read the full path in any edit approval prompt. A 'local config' edit in a repo you didn't write deserves a second look.
For Augment, where we found no confirmed fix, avoid running it on untrusted repositories, or run it in a container or separate account.

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.

GhostApproval works because an agent trusts what is in the repo. LockedVibe's free Lockdown Pack puts safer agent defaults in your project, and its $99 scan checks one app and repo for exposed secrets. LockedVibe is our sister company (same owner) and has no say over this entry. Disclosure.