{
 "public_id": "AIR-2026-0159",
 "incident_id": "2026-07-wiz-ghostapproval",
 "date_disclosed": "2026-07-08",
 "date_occurred": null,
 "title": "GhostApproval: symlinks plus a lying approval dialog let malicious repos write outside the workspace in six coding agents",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "malicious_repository_symlink",
 "agent_capability_abused": [
  "file_write",
  "symlink_following",
  "approval_dialog_rendering"
 ],
 "target_product": "Amazon Q Developer; Claude Code; Augment; Cursor; Google Antigravity; Windsurf",
 "target_vendor": "AWS; Anthropic; Augment; Anysphere; Google; Windsurf",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "unauthorized_file_write",
  "persistence"
 ],
 "blast_radius": "six major AI coding assistants; any developer who opens an untrusted repository",
 "cve": [
  "CVE-2026-12958",
  "CVE-2026-50549"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "cwe_61_symlink",
   "cwe_451_ui_misrepresentation",
   "human_in_the_loop_defeated",
   "authorized_keys_overwrite",
   "cross_vendor"
  ]
 },
 "defense_present": "the human approval dialog itself - which displayed the in-project filename rather than the real symlink target",
 "defense_bypassed": true,
 "fix_shipped": "Fixed by AWS (Q Developer language server 1.69.0, CVE-2026-12958), Cursor (3.0, CVE-2026-50549) and Google (Antigravity 1.19.6); in progress at Augment and Windsurf; initially rejected by Anthropic, which later implemented fixes independently",
 "primary_sources": [
  "https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants",
  "https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html"
 ],
 "verified_quote": "A malicious repository can trick the agent into accessing arbitrary files outside the workspace sandbox, potentially achieving remote code execution.",
 "confidence": "high",
 "notes": "Wiz Research. A repo ships a symlink named e.g. project_settings.json that actually points at ~/.ssh/authorized_keys; the agent follows it and the approval box shows the harmless in-project name. Two findings matter beyond the symlink itself: Claude Code had already identified the real target in its own reasoning but never surfaced it, and Windsurf wrote the file to disk before the Accept/Reject buttons even appeared. Overlapping discovery with Cato's DuneSlide symlink bug - the shared CVE-2026-50549 credits both teams.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agents followed the symlinks and wrote outside the workspace",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_repository_symlink",
 "guardrail_kind": [
  "human_approval"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-12958",
   "CVE-2026-50549"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (vector_family=malicious_component); ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}