For years we learned to distrust attachments.
Then npm packages.
Later Docker images.
Now a new category of risk has appeared:
repositories you open with a coding agent.
This week, researchers at Wiz Research published GhostApproval, a vulnerability affecting several of the most popular coding agents on the market.
Among them:
-
Cursor
-
Amazon Q Developer
-
Google Antigravity
-
Windsurf
-
Augment
-
Claude Code (with a different assessment from Anthropic)
What’s interesting isn’t just the bug.
It’s what it reveals about the next generation of security problems for agents.
What happened?
GhostApproval doesn’t exploit a model vulnerability.
Nor does it break the sandbox through prompt injection.
The attack reuses a technique known for decades in Unix:
symbolic links (symlinks).
A symlink looks like a normal file.
But it actually points to a completely different file.
For example:
project_settings.json
│
▼
~/.ssh/authorized_keys
The user thinks the agent is modifying a project file.
In reality it’s writing to a sensitive system file.
How does the attack work?
Imagine an apparently legitimate repository.
It contains a file called:
project_settings.json
But that file is actually a symlink to:
~/.ssh/authorized_keys
The README says something completely reasonable:
“Run the project setup.”
or
“Ask your agent to configure the workspace.”
The agent follows the instructions.
It finds the file.
It requests approval.
But the dialog only shows:
Edit project_settings.json
It doesn’t show the symlink’s actual destination.
When the user approves…
…the agent writes to authorized_keys, allowing an attacker to gain persistent access to the machine via an SSH key.
The real problem
What’s most striking about the Wiz report is that several agents detected internally that the file was a symlink.
But the interface presented to the user didn’t show that information.
In other words:
the agent knew it was writing to a sensitive file…
…but the developer didn’t.
That makes human approval almost symbolic.
The user accepts an operation without truly knowing what they’re authorizing.
Which tools were affected?
According to Wiz, the research covered:
-
Amazon Q Developer
-
Cursor
-
Google Antigravity
-
Claude Code
-
Windsurf
-
Augment
Each provider’s response was different.
What was fixed?
Cursor
Cursor classified the issue as a high-severity vulnerability and released the fix in version 3.0, assigning it the identifier CVE-2026-50549.
Amazon Q Developer
AWS resolved the issue in Language Server 1.69.0, registered as CVE-2026-12958.
In most cases the update arrives automatically when you restart the IDE.
Google Antigravity
Google changed how it presents and resolves symlinks during write operations.
Claude Code
Anthropic took a different stance.
The company argued that the user had already explicitly trusted the directory and approved the operation, so the scenario fell outside their threat model.
However, current versions (2.1.173 or later) show the symlink’s actual destination during approval, significantly reducing risk.
What does this mean for us?
More than a specific bug, GhostApproval highlights an important shift.
Coding agents no longer just read files.
They also:
-
write code,
-
modify configurations,
-
execute commands,
-
create files,
-
manage entire projects.
That means classic operating system errors acquire a completely new dimension when an agent can act autonomously.
How to protect yourself
The good news is the recommendations are quite straightforward.
1. Update your agent
If you use:
-
Cursor
-
Amazon Q Developer
-
Google Antigravity
-
Claude Code
make sure you’re running a version that includes the corresponding fixes.
2. Don’t automatically run “setup” on unknown repositories
Especially if you just cloned a project from the Internet.
Before asking the agent:
“Configure the project.”
it’s worth reviewing what files it contains.
3. Pay attention to approvals
If the agent asks to modify an apparently innocent file…
…ask yourself whether that file should really exist.
4. Use sandboxes when possible
Running agents inside isolated environments greatly reduces the impact of this type of attack.
5. Incorporate governance tools
Over recent weeks we’ve seen emerge:
-
SkillSpector
-
CodeGate
-
MCP Gateways
All respond to the same need:
better control over what our agents can do.
GhostApproval demonstrates why that security layer is becoming essential.
What’s interesting isn’t GhostApproval
What’s interesting is that it reuses a problem that’s existed for decades.
Symlinks aren’t new.
What’s new is that an agent now exists willing to automatically follow instructions on them.
That completely changes the risk model.
For years the question was:
“Can I trust this repository?”
Now we also have to ask:
“Can I trust what my agent will do inside that repository?”
They’re two different questions.
And GhostApproval is probably the first major reminder that agent security depends not only on the model.
It depends on the runtime.
On the interface.
And, above all, on how the relationship between the agent and the person who ultimately approves its actions is designed.
Resources
Wiz Research
https://www.wiz.io/blog/ghostapproval-ai-coding-agent-vulnerability
More information