GhostApproval: Flaw in Six AI Coding Assistants Lets Attackers Trick the Approval Screen

Researchers at Wiz Research have described a systematic security flaw called GhostApproval that affects six leading AI-powered coding assistants. The mechanism lets a malicious repository trick the tool into writing attacker-controlled data into a sensitive system file, such as one containing SSH keys, even though the developer sees an on-screen prompt asking for approval to edit a completely different, harmless file.

How the Attack Works

The method relies on an old trick known from Unix-based systems, a symbolic link, or symlink for short. An attacker prepares a repository where a file with an innocent-looking name, for example project_settings.json, is actually a symlink pointing to the victim's SSH authorization key file or to a shell startup file such as .zshrc.

A README file in the repository instructs the AI agent to append a configuration line to what appears to be an ordinary file. The agent follows the symlink and writes the attacker-supplied content, for instance the attacker's public SSH key, into the actual target file. The result is remote access to the developer's machine without needing a password.

A Flaw in the Approval Screen

The most serious part of GhostApproval isn't the symlink itself but how the tools inform the user about the planned operation. The confirmation window shows the file name as it appears in the repository, not the actual destination path the write will hit. A developer who clicks Approve, believing they are agreeing to a harmless change in a project configuration file, is in practice authorizing a modification to a file entirely outside the working directory.

Wiz researchers called this a bypass of informed consent. For some tools, including Amazon Q and Windsurf, the problem was even more serious, since the write to the file happened before any confirmation prompt appeared at all, completely bypassing the human-in-the-loop security model. Augment performed both the read and the write through the symlink with no approval mechanism whatsoever.

The value of AI coding assistants is simple and straightforward: the agent proposes an action, then you approve - Maor Dokhanian, Wiz Research

Dispute with Anthropic

Vendors responded differently. Amazon, Google, and Cursor released patches and thanked the researchers for their cooperation. Augment and Windsurf confirmed the issue but had no fix ready at the time the report was published. Anthropic was the only company to dispute classifying the report as a vulnerability.

This falls outside our current threat model - Anthropic, in response to the Wiz Research report

Anthropic argued that since the user knowingly trusted the directory at the start of the session and separately approved the specific edit, the decision and the responsibility rest with the user. The company also pointed out that a warning about symlinks in the edit-and-write approval window had already been added to Claude Code in version 2.1.32 on February 5, 2026, nine days before Wiz's formal report.

What This Means for Developers

The issue affects a scenario that is extremely common in everyday development work: cloning someone else's repository and running an AI agent in it to configure the project, install dependencies, or make fixes described in the documentation. Symlinks have been known as an attack vector for decades, but in classic development tools the risk was limited by the fact that a human physically executed every command. An AI agent acting on instructions from a README file blurs that boundary.

For companies using coding agents, the practical takeaway is this: the mere existence of a screen asking for approval of a change doesn't guarantee the user knows what will actually be modified. Security teams should treat cloning unknown repositories with an active AI agent the same way they treat running unknown code, including considering isolated environments and checking whether a given tool resolves symlinks before writing.

Wiz also described detection mechanisms for this type of attack in its own product, Wiz Sensor, covering the moment a repository is cloned, the moment a write occurs to sensitive files, and the context of an AI agent's activity as a signal of elevated risk. The GhostApproval case shows that as AI agents are granted growing autonomy over file access, the boundaries of trust between the user, the agent, and the file system need to be defined more clearly than they have been so far.