TL;DR: On July 8, 2026, Wiz disclosed GhostApproval — a symlink flaw in six major AI coding agents. A malicious repo ships a file like project_settings.json that is secretly a symlink to ~/.ssh/authorized_keys or ~/.zshrc; when the agent “edits” it, the write follows the link and lands on your SSH keys or shell profile. The kicker: the approval prompt names the harmless file, even when the agent’s own reasoning already spotted the real target. Amazon Q, Cursor, and Google Antigravity are patched. Augment and Windsurf are not. If you clone untrusted repos, this is your problem today.

Tool	Patched?	Version / date	CVE
Amazon Q Developer	✅ Yes	Language server v1.69.0, May 27 2026	CVE-2026-12958
Cursor	✅ Yes	v3.0, Jun 5 2026	CVE-2026-50549
Google Antigravity	✅ Yes	Fix deployed May 22 2026	Under assessment
Claude Code	⚠️ Warns, disputes bug	Symlink warning v2.1.32 (Feb 5) / resolves symlinks v2.1.173+	None
Augment	❌ No	Patch “in progress,” no date	—
Windsurf	❌ No	Acknowledged, no fix, no warning	—

Honest take: GhostApproval is not exotic — it’s a 1970s Unix feature meeting a 2026 trust model that never accounted for it. If you only ever open repos from your own org, your practical risk is low. If you routinely clone strangers’ code to try it out, update Cursor and Amazon Q now, and stop letting Augment or Windsurf touch an untrusted repo until they ship a fix. One find . -type l before the agent runs is cheaper than rotating your SSH keys after.

What GhostApproval actually is

Wiz published the research on July 8, 2026, after a coordinated disclosure window of more than 90 days. The name describes the failure precisely: the human approval that’s supposed to guard every file write becomes a ghost — present on screen, but not actually protecting the thing you think it is.

The flaw affects six of the most-used AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. It abuses the symbolic link, a decades-old filesystem feature that lets one path transparently stand in for another. Write to the symlink, and the operating system quietly redirects that write to wherever the link points. Every one of these agents failed to check whether a file it was about to edit was really a symlink pointing somewhere outside the project.

This is a different attack class from the two security stories this site has already covered. Agentjacking is social engineering through an injected Sentry error. The Amazon Q MCP credential-theft CVE is auto-execution of a malicious MCP config on git clone. GhostApproval is neither — it’s a sandbox escape on file write, and the defenses are different. Same six tools keep showing up because they all share the same architecture: an autonomous agent with filesystem access and a human-in-the-loop approval step that everyone assumed was airtight.

How the attack works, step by step

Wiz built a proof-of-concept repository. Here is the chain, sanitized — it’s public and widely reported, shown so you can recognize it, not run it.

1. The attacker crafts a repo. It contains a file named something innocuous — Wiz used project_settings.json. But that file isn’t a JSON file. It’s a symlink pointing to a sensitive target on the victim’s machine, for example ~/.ssh/authorized_keys (your SSH login file) or ~/.zshrc (your shell startup script).

2. The repo’s README carries the instruction. It tells the agent to “add a line” to project_settings.json. That line, in Wiz’s PoC, is the attacker’s own SSH public key.

3. You open the repo in your agent and ask it to do the setup the README describes, or the agent reads the README as context and acts on it. This is normal agent behavior — reading project files to understand what to do is the entire point of these tools.

4. The agent writes to project_settings.json. The OS follows the symlink. The write lands on ~/.ssh/authorized_keys instead. The attacker’s key is now trusted for SSH login to your machine. Point it at ~/.zshrc instead and you get arbitrary code execution the next time you open a terminal.

No exploit code runs during the clone. No malware. No CVE in the OS. The agent did exactly what it was told — it just wrote to a file that was lying about where it lived.

The real bug: an approval prompt that lies

The symlink resolution failure is the mechanism. The reason GhostApproval is dangerous rather than merely theoretical is the informed-consent bypass, and it’s worth dwelling on because it’s the part that turns your safety net into a trap.

When Wiz tested Claude Code, the agent’s internal reasoning had already worked out what was going on. Its own logs noted that project_settings.json was “actually a zsh configuration file.” The model saw the deception. But the confirmation dialog shown to the developer — the “Make this edit to project_settings.json?” prompt — named only the harmless file. The information the agent had was never surfaced to the person clicking Accept.

So you approve an edit to what you believe is a local project config. The write hits your shell profile or your SSH keys. The human-in-the-loop control that’s supposed to be the last line of defense becomes a rubber stamp, because it’s asking you to approve a fiction.

Windsurf’s variant is worse. Wiz found that Windsurf writes the file to disk before the Accept/Reject buttons even appear. The dialog isn’t an authorization gate at all — it’s an undo button, offered after the attacker’s key is already in place. Clicking Reject doesn’t stop the write; it asks you to clean up after it.

That distinction — approval-before-write versus write-before-approval — is the line between a tool that has a fixable prompt and one whose architecture is inverted.

Who patched it, and who didn’t

This is the part that decides what you should do today. Patch status as of the July 8 disclosure:

Amazon Q Developer — patched. AWS fixed it in language server v1.69.0, deployed May 27, 2026, and assigned CVE-2026-12958. Note this is a sibling of, not the same as, the earlier MCP credential-theft CVE this site covered — different finding, same umbrella of Amazon Q hardening. Check your version in the VS Code Extensions panel and confirm you’re on ≥1.69.0.

Cursor — patched. Fixed in v3.0, June 5, 2026, under CVE-2026-50549. Confirm via Help → About that you’re on 3.0 or later. If you’re still on a 2.x build, update before your next untrusted clone.

Google Antigravity — patched. Google deemed it a critical bug and deployed a fix on May 22, 2026. As of disclosure, Google was still assessing whether to issue a CVE.

Claude Code — warns, and disputes it’s a bug. This is the nuanced one, and the reporting is worth reading carefully. Anthropic’s position is that Claude Code already resolves symlinks and warns users before writing to sensitive files, and that this behavior wasn’t a reaction to GhostApproval. Anthropic told Wiz the symlink warning in the Edit/Write permission dialog shipped in v2.1.32 on February 5, 2026 — nine days before the report was even submitted, as part of proactive internal security hardening. Current versions (v2.1.173+) resolve symlinks and warn before writing to sensitive files. So Claude Code doesn’t have a pending patch because, by Anthropic’s account, the mitigation was already there. If you’re on a recent Claude Code build, you get a warning; make sure you actually read it rather than reflexively approving.

Augment — not patched. Augment acknowledged the report and says a patch is “in progress” with no release date. Until then, treat any untrusted repo as capable of writing to your SSH keys through Augment.

Windsurf — not patched, and no warning. Windsurf acknowledged the vulnerability but has neither shipped a fix nor added a warning, and its write-before-approval design means the confirmation prompt offers no protection anyway. This is the highest-risk tool on the list right now.

What you should actually do

The mitigations split into “update your tool” and “change your workflow.” Do both.

Update, then verify the version

• Cursor: Help → About → confirm ≥ v3.0.
• Amazon Q: VS Code Extensions panel → confirm language server ≥ 1.69.0.
• Claude Code: run claude --version and confirm ≥ 2.1.173, then don’t dismiss the symlink warning without reading it.
• Augment / Windsurf: no fix exists. Version-checking won’t help — change the workflow instead.

Workflow defenses that work on every tool

These matter most for the unpatched tools, but they’re good hygiene regardless of what you run:

1. Scan for symlinks before the agent touches anything. From the repo root:

   find . -type l -ls

   This lists every symlink and where it points. If you see a “config file” that resolves to ~/.ssh/, ~/.zshrc, ~/.bashrc, ~/.gitconfig, or anything outside the project tree, that’s the attack. Delete it before you let the agent run.

2. Sandbox untrusted repos. Open unknown code inside a Docker container or a throwaway VM where your real SSH keys and shell profile don’t exist. A symlink to ~/.ssh/authorized_keys is harmless when that path is empty. This is the single most effective defense because it neutralizes the entire class, not just this one flaw.

3. On Windows, disable symlink resolution at clone time.

   git clone --config core.symlinks=false <repo-url>

   Git then materializes symlinks as plain text files instead of live links, so a write can’t traverse them.

4. Scope the agent’s working directory. For Claude Code, launch it with an explicit working directory so its filesystem view is confined to the project. Anthropic notes this doesn’t fully prevent symlink traversal on its own, so treat it as defense-in-depth, not a substitute for the scan above.

5. Keep per-edit approval on for untrusted code. Auto-approve / “yolo” modes remove the one moment where you might notice a filename that doesn’t look right. For repos you don’t trust, the friction is the feature.

If you run local models to keep your code and credentials off cloud infrastructure entirely, the runaihome.com local LLM hardware guide covers building a self-hosted coding stack — worth pairing with the sandboxing advice above, since a local agent still writes to your real filesystem and is just as vulnerable to a symlink it doesn’t check.

How GhostApproval fits the bigger pattern

Three separate attacks on the same six tools in under a month tells you something. Agentjacking exploited trust in external data (a Sentry error). The MCP credential-theft CVE exploited trust in config auto-execution (a .mcp.json run on clone). GhostApproval exploits trust in filenames (a symlink the agent doesn’t resolve before writing).

The common thread is that AI coding agents were built to be helpful first and adversarial-input-resistant second. Every one of these flaws is a case of the agent trusting something — a bug report, a config file, a filename — that an attacker controls. The Register put it well: these are Unix-era security headaches that never really died; they just got a new, autonomous victim that acts on them faster than a human would.

The takeaway for your workflow isn’t “AI coding tools are unsafe.” It’s that the boundary between “code I wrote” and “code a stranger wrote” has to be enforced by you, not assumed by the tool. Clone untrusted repos into a sandbox. Read the approval prompts. Keep your tools current. The agent will keep getting more capable; the blast radius of a bad write scales with it.

FAQ

Am I affected if I only open my own company’s repos? Practically, no. GhostApproval requires you to clone or open a repo an attacker controls. If every repo you open comes from a trusted org, your exposure is low. The risk concentrates on developers who try out random GitHub projects, review external contributions locally, or work with client-supplied code.

Does clicking “Reject” on the approval prompt save me? Depends on the tool. In tools that write after approval, rejecting stops the write. In Windsurf, the file is written to disk before the buttons appear, so Reject only asks you to undo damage already done. That’s why Windsurf is the highest-risk tool until it patches.

Is Claude Code safe or not? Anthropic says Claude Code already resolves symlinks and warns before writing to sensitive files, with the warning shipping in v2.1.32 back on February 5, 2026 — before the report — and full resolution in v2.1.173+. There’s no pending patch because Anthropic doesn’t consider it an open bug. The practical answer: update to a recent version and actually read the symlink warning instead of reflexively approving.

What’s the difference between this and the Amazon Q MCP CVE from June? The June CVE was about a malicious MCP config auto-executing when you cloned a repo. GhostApproval is about a symlinked file redirecting an agent’s write to your SSH keys or shell profile. Different mechanism, different CVE (CVE-2026-12958 for the GhostApproval Amazon Q fix), same “clone a bad repo” trigger.

How do I check for the attack in a repo right now? Run find . -type l -ls in the repo root before letting any agent touch files. It lists every symlink and its target. Anything pointing outside the project — especially into your home directory’s dotfiles or .ssh — is a red flag.

Should I stop using AI coding agents? No. The fix is workflow discipline, not abandonment: update patched tools, sandbox untrusted code, and keep per-edit approval on when you don’t trust the source. The tools that patched (Cursor, Amazon Q, Google Antigravity) are safe on current versions.

Sources

• Wiz — GhostApproval: A Trust Boundary Gap in AI Coding Assistants (July 8, 2026) — primary research: attack mechanics, disclosure timeline (discovered Feb 10, reported Feb 12–Mar 5, disclosed July 8), per-tool patch status.
• The Hacker News — GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents (July 8, 2026).
• The Register — Bug in top AI coding agents shows that Unix-era security headaches never really die (July 8, 2026).
• Infosecurity Magazine — GhostApproval Flaw Hits Six Major AI Coding Assistants.
• CybersecurityNews — New GhostApproval Vulnerability Affects Amazon Q, Claude Code, Cursor, and Other AI Agents — CVE and version details (Amazon Q v1.69.0 / CVE-2026-12958, Cursor v3.0 / CVE-2026-50549, Google fix May 22).
• GBHackers — GhostApproval Attack Impacts Amazon Q, Claude Code, Cursor, Google Antigravity, and Windsurf.
• SC Media — ‘GhostApproval’ technique leads AI coding tools to alter files outside of sandbox.
• DevOps.com — GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools.

Last verified: Jul 10 2026 against Wiz’s disclosure and corroborating coverage from The Hacker News, The Register, Infosecurity Magazine, CybersecurityNews, GBHackers, SC Media, and DevOps.com. Patch versions and CVE IDs current as of the July 8 2026 disclosure; check each tool’s release notes for updates.