GhostApproval flaw impacts six AI coding assistants

A newly discovered security vulnerability pattern affecting six of the most widely used AI coding assistants could allow attackers to gain remote control of a developer's computer by tricking the tools into bypassing their own safety prompts. The flaw, dubbed "GhostApproval" by researchers at cybersecurity firm Wiz, impacts Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf (now known as Devin Desktop).

The vulnerability exploits a decades-old Unix feature known as a symbolic link, or symlink, which acts as a shortcut pointing to another file or directory. In an attack scenario, a malicious repository is created containing a symlink disguised as a harmless configuration file, such as project_settings.json, which secretly points to a sensitive system file like the developer's SSH authorized keys or shell startup file. When a developer clones the repository and instructs their AI coding assistant to set up the workspace, the agent follows the instructions and writes attacker-controlled data through the symlink to the sensitive target file. This could grant an attacker persistent, passwordless SSH access to the machine or allow execution...