Symlinks Trick Six AI Coding Assistants, Three Still Unpatched

Researchers at Wiz Research have described an attack technique called GhostApproval that uses symbolic links to trick AI coding assistants. The agent shows an innocuous-looking file name in the approval dialog, but actually writes data to a completely different, sensitive location on the developer's disk.

How the swap works

The mechanism relies on a decades-old Unix feature - symbolic links, files that actually point to a different location. An attacker prepares a repository containing a file named project_settings.json that is technically a symlink leading to the ~/.ssh/authorized_keys file, the list of SSH keys authorized to log into the victim's account.

A README in such a repository instructs the AI assistant to "add a line" to a seemingly harmless configuration file. During analysis, the agent recognizes where the link actually leads, but the approval dialog shown to the user displays only the symlink's name, not the real write target.

You need to resolve the symlink and show the real target before asking, flag any write that goes outside the project folder, and never touch the disk before the user has actually approved the operation - Wiz Research

When the developer clicks "approve," believing they are editing a local config file, the write follows the link and lands at the real target. In the scenario described by the researchers, this results in the attacker's SSH key being placed in the victim's authorized-keys file, giving them passwordless remote access to the machine. A second version of the attack targets shell startup files, such as ~/.zshrc, which execute automatically every time a terminal is opened.

Which tools were affected

Wiz tested the technique on six widely used coding assistants: Amazon Q Developer, Anthropic's Claude Code, Cursor, Google Antigravity, Augment, and Windsurf. In all six, the researchers confirmed that the approval dialog can be made to show misleading information, which strips the user's confirmation of any real security function.

Vendor responses varied. Amazon patched the flaw in Language Server version 1.69.0 and assigned it CVE-2026-12958. Cursor fixed the issue in version 3.0 under CVE-2026-50549. Google confirmed the bug in Antigravity and released a patch, though CVE assignment is still pending. Augment and Windsurf confirmed receiving the report but had not published fixes by the time the report was published.

Dispute with Anthropic

Anthropic's response was the most unusual. The company initially deemed the report outside Claude Code's accepted threat model, declining to treat it as a security vulnerability. Even so, in version 2.1.32, released in February 2026 - before Wiz's formal disclosure on February 14 - Anthropic added symlink warnings to the tool, which some researchers read as a quiet acknowledgment of the problem without a formal vulnerability classification.

The researchers note that GhostApproval isn't an isolated case but rather a recurring architectural pattern across the entire category of tools. In May 2026, Adversa AI described a similar technique called SymJack, demonstrating the same flaw in a different set of coding agents. This suggests the problem doesn't stem from a single vendor's bug but from a widely adopted way of implementing approval dialogs in AI tools.

What it means for developers

For Polish development teams using coding agents, the key point is that the attack requires no security review or special privileges - it's enough to clone a malicious repository and ask the AI assistant for help setting it up. That's a routine action developers perform multiple times a day, often without deeper verification of the code's source.

Until Augment and Windsurf release patches, the researchers recommend caution with repositories from unknown sources and manually verifying that files shown in approval dialogs are actually located inside the project directory, not outside it. Users of Amazon Q Developer, Cursor, and Google Antigravity should update to the patched versions as soon as possible.