Critical GhostApproval Flaw in Amazon Q, Claude, Cursor Exposes AI Agents

Key Takeaways

• A new vulnerability pattern, “GhostApproval,” impacts six prominent AI coding assistants.
• The flaw leverages symbolic link following to bypass human oversight, potentially leading to remote code execution.
• Affected products include Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.
• Several vendors have issued patches, while others are still addressing the issue.

“GhostApproval” Flaw Exposes AI Coding Assistants to Remote Code Execution

A significant security vulnerability, dubbed “GhostApproval,” has been uncovered in six widely used AI coding assistants. This critical flaw allows attackers to bypass “Human-in-the-Loop” safety mechanisms, potentially enabling remote code execution on developers’ machines. The affected platforms include Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

Exploiting Symbolic Links for Malicious Access

The GhostApproval vulnerability, identified by Wiz researchers, exploits a known technique: symbolic link following (CWE-61). A symbolic link, or symlink, is a file system entry that points to another file or directory. While symlink exploits have a long history in areas like Docker escapes (CVE-2024-21626), npm package managers (CVE-2021-32803), and Linux privilege escalation, its application to AI coding agents introduces a novel attack surface.

The attack scenario is straightforward. An adversary crafts a malicious code repository containing a symlink, for instance, directing project_settings.json to a sensitive system file like ~/.ssh/authorized_keys. When a developer clones this repository and instructs their AI assistant to “set up the workspace,” the assistant inadvertently follows the symlink. This action causes the AI to write an attacker-controlled SSH public key directly into the victim’s authorized_keys file, thereby granting the attacker persistent, password-less SSH access to the developer’s workstation.

UI Misrepresentation Bypasses User Consent

What distinguishes GhostApproval from a typical symlink exploit is its integration with UI misrepresentation (CWE-451). A particularly concerning example was observed in Anthropic’s Claude Code. During testing, the AI agent’s internal logs explicitly recognized that “project_settings.json is actually a zsh configuration file.” However, the prompt presented to the user simply asked, “Make this edit to project_settings.json?”

This discrepancy is critical. The AI agent possessed the correct information about the symlink’s true target, but this crucial detail was concealed from the user. Consequently, the user, unaware of the actual file being modified, effectively grants consent for a malicious operation. This transforms the “Human-in-the-Loop” safety mechanism into a superficial approval process, undermining its intended security function.

Vendor Responses and Patch Status

Following the disclosure, several vendors have taken action to address GhostApproval:

• Amazon Web Services: Patched Amazon Q Developer in language server version 1.69.0 on May 27, 2026, assigning CVE-2026-12958. The update is automatic and can be triggered by reloading the IDE.
• Cursor: Released a fix in v3.0 on June 5, 2026, under CVE-2026-50549.
• Google (Antigravity): Deployed a fix on May 22, 2026, in v1.19.6 and is currently evaluating whether to issue a CVE.
• Augment and Windsurf: Acknowledged the reports but have not yet provided public updates on their patching progress. Windsurf’s pre-authorization variant was particularly hazardous, as the agent would write to disk before presenting an “Accept/Reject” dialog, effectively making the dialog an “undo” button rather than a true authorization gate.
• Anthropic (Claude Code): Initially disputed the report, citing that the issue fell outside their threat model due to user-trusted directories and approved prompts. However, Anthropic later clarified that a symlink warning had been proactively implemented in version 2.1.32 on February 5, 2026, prior to the vulnerability report submission. Versions 2.1.173+ also resolve symlinks and issue warnings before writing to sensitive files.

The initial discovery of GhostApproval occurred on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure was made on July 8, 2026, adhering to a 90-day coordinated disclosure timeline.

Wiz researchers outlined three essential mitigations for AI coding tool vendors:

• Canonical Path Resolution: Always resolve symlinks to their canonical target paths before displaying prompts to users, ensuring the true destination is shown, not just the symlink name.
• Explicit Out-of-Workspace Warnings: Provide clear and distinct warnings when a resolved path attempts to write outside the current workspace. A write to a critical system file like ~/.ssh/authorized_keys must be visually and contextually differentiated from a write to a local configuration file.
• Pre-Authorization Writes: Never write to disk before explicit user authorization. Confirmation dialogs must serve as mandatory gates for approval, not merely as options to undo a completed action.

GhostApproval represents a systemic design flaw across AI coding tools, rather than isolated bugs. As AI agents gain more control over developers’ file systems, robust “Human-in-the-Loop” controls must be prioritized as a fundamental security requirement.

What You Should Do

• Update Immediately: Ensure your AI coding assistant is updated to the latest available version. Check vendor announcements for specific patch details for Amazon Q Developer, Cursor, and Google Antigravity.
• Exercise Caution with Repositories: Be highly suspicious of cloning and executing setup instructions from untrusted or unfamiliar code repositories, even when using AI assistants.
• Review AI Prompts Carefully: Pay close attention to the exact wording of any prompts from your AI assistant that request file modifications, especially those involving configuration files or system directories.
• Verify File Paths: If an AI assistant proposes writing to a file, and you have any doubt, manually verify the actual file path before approving the action.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.