Return to Threats

GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

thehackernews.com 2026-07-09 AI agent abuse Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A symlink flaw in six AI coding assistants could let malicious repositories redirect an approved file write to a sensitive file and run code on a developer’s computer. Organizations using these assistants should prioritize agent permission, filesystem, and repository security.

What Happened

Researchers at Wiz found that a flaw in six popular AI coding assistants lets a booby-trapped code project quietly take control of a developer's computer. The assistant asks permission to edit one harmless-looking file, but the write lands on a sensitive one instead. The affected tools are Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

Affected Products

  • Amazon Q Developer
  • Anthropic's Claude Code
  • Augment
  • Cursor
  • Google Antigravity
  • Windsurf

Vulnerability / Attack Technique

Symlink-based path redirection

Technical Mechanism

The assistant asks permission to edit one harmless-looking file, but the write lands on a sensitive file instead. The article summary states that a booby-trapped code project can use this flaw to quietly take control of a developer’s computer.

AI Security Category

LLM06:2025 Excessive Agency

Part of the AI Agent Excessive Agency topic.

Relevant Frameworks

LLM06:2025 Excessive AgencyLLM03:2025 Supply ChainMITRE ATLAS: Execution

RealGround Analysis

The issue demonstrates how excessive permissions in AI coding agents can turn repository content into a path to host compromise. Teams running AI agents should treat untrusted code projects as hostile inputs and verify that requested file operations cannot be redirected to sensitive locations.

Recommended Controls

  • Restrict AI coding agents to isolated workspaces with least-privilege filesystem access.
  • Validate and canonicalize file paths before approving or executing write operations, including symlink checks.
  • Require explicit approval for writes outside the project workspace or to sensitive files.
  • Run untrusted repositories in sandboxed environments separated from developer credentials and production systems.
  • Red-team AI coding agents with malicious repositories and symlink-based file-operation tests.

Related RealGround Service

Secure AI Agent Build · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-18.

Talk to AI CISO