GhostApproval Bug Breaks 6 Top AI Coding Agents
Skip to content
Navigation
- News
- Events
- TNW Conference
- June 19 & 20, 2025
- All events
- TNW Conference
- Newsletters
- Partner with us
- Jobs
- Contact
Main Content
Deep tech | Sustainability | Ecosystems | Data and security | Fintech and ecommerce | Future of work
Amazon: One symlink trick breaks 6 top AI coding agents
Security firm Wiz found one old Unix trick that breaks six popular AI coding assistants, from Amazon Q to Cursor. A booby-trapped repository can walk an agent past its own safety prompt. The payoff is a planted key that hands an attacker the developer’s machine.
July 8, 2026 – 4:23 pm
Image by: Shutterstock
Security firm Wiz discovered a vulnerability, named GhostApproval, affecting six widely used AI coding agents: Amazon Q Developer, Anthropic’s Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This ancient bug dates back decades and leverages symbolic links (symlinks).
How the trap works:
The attacker creates a poisoned repository containing a cleverly disguised symlink masquerading as an innocent config file, for example, project_settings.json. A README guides the victim’s AI assistant to add a line to this "config" during setup.
Once cloned by a developer, the agent follows instructions and writes an attacker-controlled SSH key into the legitimate keys file, granting unauthorized access to the machine. This is reminiscent of a previous booby-trapped-repo flaw in Amazon Q.
The problem with rubber-stamping:
Most of these AI assistants display confirmation boxes before performing risky actions. However, Wiz discovered that these prompts sometimes omitted crucial details. Although the agents recognized the symlink pointed to a dangerous location, the prompt only displayed the harmless filename.
Claude Code was particularly problematic, as its internal reasoning identified the file as a shell config and then presented a seemingly innocuous question: "Make this edit to project_settings.json?" Wiz classified this as a significant flaw, arguing that the consent given was effectively empty. They also noted a separate issue with UI misrepresentations regarding what actions the user is approving.
Who addressed it:
- Amazon, Cursor, and Google treated this as a genuine bug, issuing CVEs and releasing patches for Q Developer, Cursor 3.0, and Antigravity, respectively.
- Augment and Windsurf identified the issue as critical but had not released patches at the time of writing.
- Anthropic, despite initial pushback, later acknowledged the problem predating their report and implemented a fix. Claude Code’s proactive warning for symlinks was shipped on February 5th, nine days before Wiz reported it.
Why it matters:
Enterprises frequently grant these AI assistants deep access to their code and cloud infrastructure. When safety prompts fail to disclose potential dangers, human oversight becomes meaningless. Vendors must ensure that their UI designs don’t inadvertently trap users into approving risky actions.