AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique

Wiz has disclosed the details of a new AI coding assistant attack method it has dubbed GhostApproval. The post AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique appeared first on SecurityWeek .

According to Wiz’s disclosure, GhostApproval is a systemic vulnerability pattern in multiple AI coding assistants where malicious repositories abuse symbolic links to trick agents into reading or writing files outside the trusted workspace, such as SSH keys or shell startup files, enabling data theft and remote code execution on developer machines.[1][3][4] Several major tools (e.g., Amazon Q Developer, Anthropic Claude Code, Cursor, Google Antigravity, Augment, Windsurf) were affected, with some vendors issuing patches and CVEs, indicating broad supply-chain-style exposure for development environments.[1][3] From a RealGround perspective, this represents AI agent abuse and AI supply chain risk: AI coding agents must be treated as untrusted executors, with hard workspace isolation, least-privilege permissions, mandatory human approval for file- and shell-affecting actions, and continuous red teaming to detect similar symlink and path-trust bypass patterns in other AI-integrated developer tools.[1][4] Organizations should also audit AI agent business logic and tool-routing rules, and include AI coding assistants in SBOM and supply chain reviews since compromised or misconfigured age