What happened

Security researchers at Wiz found a shared weakness in six AI coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

The attack uses a symbolic link, or symlink. A symlink looks like a normal file but points somewhere else on the computer. A malicious repository can disguise a link to ~/.ssh/authorized_keys as a harmless project file, then ask the agent to edit it.

The agent follows the link and writes to the sensitive file outside the project. In the worst case, that can give an attacker persistent access to the developer’s machine.

Wiz called the pattern GhostApproval because the approval prompt can show the harmless-looking project path while the write reaches a different file. In its Claude Code test, the agent recognized the dangerous target in its reasoning, but the prompt still asked the user to approve an edit to project_settings.json.

Why it matters

Most coding agents present approval prompts as a safety boundary. The user sees a proposed file change, checks it, and decides whether to continue.

GhostApproval shows why that model breaks when the path in the prompt is not the path the operating system will use. The user can make the careful decision the interface asks for and still approve the wrong action.

This is not only a Claude Code problem. Wiz found variations across six tools, which makes it a design problem for the whole category. AI coding agents read instructions from repositories, write files, and run commands. That gives an ordinary project file more influence than it would have in a normal editor.

Wiz says AWS, Cursor, and Google fixed their versions. Anthropic disputed the report’s classification, saying the scenario fell outside Claude Code’s threat model because the user trusted the directory and approved the edit. Wiz also says current Claude Code versions resolve symlinks and warn users before writing to sensitive files.

Who should care

Anyone who asks a coding agent to set up an unfamiliar repository should care. This includes builders cloning starter projects, following open-source tutorials, or accepting a repository’s README instructions without reading them first.

The risk is higher when the agent can access your home directory, shell configuration, SSH keys, cloud credentials, or other files outside the project. A trusted repository is not automatically a safe repository. Its instructions and file structure can both be part of the attack.

This also gives a sharper meaning to “human in the loop.” A confirmation box only protects you when it identifies the real file and appears before the write happens.

What builders should do next

Update Claude Code before working in unfamiliar repositories:

claude update
claude --version

The first command installs the latest available build. The second confirms which version is running. Wiz says versions 2.1.173 and later resolve symlinks and warn before writes to sensitive files.

Before asking an agent to set up a repository, inspect its instructions and look for symlinks:

find . -type l -ls

You do not need to understand every result. A link from a project file to a path in your home directory deserves attention before you approve an edit.

The practical takeaway is simple: treat an unfamiliar repository as input to inspect, not instructions to obey. An approval prompt is useful only when it shows the real destination and stops the write until you agree.

End of article