AI assistants for programming should speed up the developer’s work, but the new Wiz find shows the reverse side of autonomous agents: one failed repository request can open access to files outside the working folder and lead to the execution of code on the developer’s machine.
Wiz researchers found a recurring design error in six popular code-pending tools using AI. The problem was named GhostApprovalGhostApproval. According to the company, the vulnerable approach affected Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravi and Windsurf. The main danger is not associated with a rare cryptographic error or a complex chain of exploits, but with a long-known mechanism of symbolic links.
The symbolic link looks like a regular file or directory, but actually leads to another place in the file system. Attackers have been using such links for years to circumvent access restrictions and withdraw operations beyond the permitted area. In the MITRE classification, this problem is described as CWE-61. In the case of GhostApproval, the old technique met with a new AI-agent architecture that read instructions from the project, offer edits and ask the developer to confirm the action.
The attack begins with a malicious repository. The attacker adds to the project a file that looks like an ordinary configuration, such as project_settings.json, but actually leads to a sensitive file outside the working folder, such as ~/.sh/sh/authorized_keys. Then the README contains instructions to update the configuration and add the specified SSH key. The developer clones the repository and asks the AI agent to prepare the working environment or execute instructions from README.
\
Then the main problem works. The agent understands the task, opens the confirmation dialogue and shows the user a harmless file name within the project. The real purpose of the operation is hidden. The developer thinks that it confirms the change in the local configuration, and the agent records the attacker’s key in the message_keys. After such recording, the attacker receives long-term access to the machine via SSH without a password.
Wiz emphasizes that vulnerability breaks the very idea of a person’s verification. Formally, there is confirmation, but the developer does not see critical information and can not make a conscious decision. According to the researchers, the classic security principles, including the resolution of symbolic links before performing operations with files, cannot be ignored just because the action is performed by an AI agent.
At the time of publication, there were no signs of active operation of GhostApproval in real attacks. But the risk for companies remains serious: AI tools for code often get access to corporate repositories, local files, cloud accounting data, and development environments. An error in the trust boundary makes a handy tool into an intermediary, which, according to someone else’s instructions, changes important files on the developer’s behalf.
The reaction of suppliers was different. Amazon recognized the problem in Q Developer as a vulnerability of a high degree of danger, corrected the error and released the CVE-2026-12958 identifier. Cursor also prepared a fix, included it in version 3.0 and issued CVE-2026-50549. Google rated the error in Antigravity as critical and unfolded the fix on May 22, and the issue of individual CVE was still considered.
Anthropic first told Wiz that the described attack goes beyond the Claude Code threat model. The company explained that before launching the tool, the user confirms that he considers the working folder safe, and then separately allows the operation with the file. Therefore, the situation with a malicious symbolic link within such an Anthropic project did not consider the Claude Code to be a full vulnerability.
Later, Claude Code received warnings when working with symbolic links and sensitive files. Anthropic spokesperson said the warning had been added to version 2.1.32 as early as 5, 2026, nine days before the Wiz report, as part of the internal security enhancements.
Augment and Windsurf received the Wiz report and found the problem, but at the time of publication they did not release a fix. A representative of Augment said that a programming agent should be able to edit and run code, and when performing such actions, he works with user rights. According to the position of the company, the developers are partly responsible and should treat the code for AI agents as carefully as the code that is run manually.
Wiz believes that GhostApproval shows a weak spot of protection built on user support. If the dialogue hides the real purpose of the operation, the developer cannot make an informed decision, and consent becomes formal.
Wiz researchers found a recurring design error in six popular code-pending tools using AI. The problem was named GhostApprovalGhostApproval. According to the company, the vulnerable approach affected Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravi and Windsurf. The main danger is not associated with a rare cryptographic error or a complex chain of exploits, but with a long-known mechanism of symbolic links.
The symbolic link looks like a regular file or directory, but actually leads to another place in the file system. Attackers have been using such links for years to circumvent access restrictions and withdraw operations beyond the permitted area. In the MITRE classification, this problem is described as CWE-61. In the case of GhostApproval, the old technique met with a new AI-agent architecture that read instructions from the project, offer edits and ask the developer to confirm the action.
The attack begins with a malicious repository. The attacker adds to the project a file that looks like an ordinary configuration, such as project_settings.json, but actually leads to a sensitive file outside the working folder, such as ~/.sh/sh/authorized_keys. Then the README contains instructions to update the configuration and add the specified SSH key. The developer clones the repository and asks the AI agent to prepare the working environment or execute instructions from README.
\
Then the main problem works. The agent understands the task, opens the confirmation dialogue and shows the user a harmless file name within the project. The real purpose of the operation is hidden. The developer thinks that it confirms the change in the local configuration, and the agent records the attacker’s key in the message_keys. After such recording, the attacker receives long-term access to the machine via SSH without a password.
Wiz emphasizes that vulnerability breaks the very idea of a person’s verification. Formally, there is confirmation, but the developer does not see critical information and can not make a conscious decision. According to the researchers, the classic security principles, including the resolution of symbolic links before performing operations with files, cannot be ignored just because the action is performed by an AI agent.
At the time of publication, there were no signs of active operation of GhostApproval in real attacks. But the risk for companies remains serious: AI tools for code often get access to corporate repositories, local files, cloud accounting data, and development environments. An error in the trust boundary makes a handy tool into an intermediary, which, according to someone else’s instructions, changes important files on the developer’s behalf.
The reaction of suppliers was different. Amazon recognized the problem in Q Developer as a vulnerability of a high degree of danger, corrected the error and released the CVE-2026-12958 identifier. Cursor also prepared a fix, included it in version 3.0 and issued CVE-2026-50549. Google rated the error in Antigravity as critical and unfolded the fix on May 22, and the issue of individual CVE was still considered.
Anthropic first told Wiz that the described attack goes beyond the Claude Code threat model. The company explained that before launching the tool, the user confirms that he considers the working folder safe, and then separately allows the operation with the file. Therefore, the situation with a malicious symbolic link within such an Anthropic project did not consider the Claude Code to be a full vulnerability.
Later, Claude Code received warnings when working with symbolic links and sensitive files. Anthropic spokesperson said the warning had been added to version 2.1.32 as early as 5, 2026, nine days before the Wiz report, as part of the internal security enhancements.
Augment and Windsurf received the Wiz report and found the problem, but at the time of publication they did not release a fix. A representative of Augment said that a programming agent should be able to edit and run code, and when performing such actions, he works with user rights. According to the position of the company, the developers are partly responsible and should treat the code for AI agents as carefully as the code that is run manually.
Wiz believes that GhostApproval shows a weak spot of protection built on user support. If the dialogue hides the real purpose of the operation, the developer cannot make an informed decision, and consent becomes formal.
