Disclosed vulnerability
GhostApproval: symlinks plus a lying approval dialog let malicious repos write outside the workspace in six coding agents
AIR-2026-0159 AIR record · 2026-07-wiz-ghostapproval
From the supporting source
A malicious repository can trick the agent into accessing arbitrary files outside the workspace sandbox, potentially achieving remote code execution.wiz.io
The record
Disclosed
2026-07-08
Vendor
AWS; Anthropic; Augment; Anysphere; Google; Windsurf
Product
Amazon Q Developer; Claude Code; Augment; Cursor; Google Antigravity; Windsurf
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted — the agents followed the symlinks and wrote outside the workspace
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious repository symlink
Impact type
Remote code execution, Unauthorized file write, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
six major AI coding assistants; any developer who opens an untrusted repository
Capability abused
Defense & remediation
Recorded defense
the human approval dialog itself - which displayed the in-project filename rather than the real symlink target
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
Fixed by AWS (Q Developer language server 1.69.0, CVE-2026-12958), Cursor (3.0, CVE-2026-50549) and Google (Antigravity 1.19.6); in progress at Augment and Windsurf; initially rejected by Anthropic, which later implemented fixes independently
Taxonomy & references
Curator notes
Wiz Research. A repo ships a symlink named e.g. project_settings.json that actually points at ~/.ssh/authorized_keys; the agent follows it and the approval box shows the harmless in-project name. Two findings matter beyond the symlink itself: Claude Code had already identified the real target in its own reasoning but never surfaced it, and Windsurf wrote the file to disk before the Accept/Reject buttons even appeared. Overlapping discovery with Cato's DuneSlide symlink bug - the shared CVE-2026-50549 credits both teams.
Supporting sources
Cite as
Enkrypt AI. "GhostApproval: symlinks plus a lying approval dialog let malicious repos write outside the workspace in six coding agents". AIR, AIR-2026-0159. https://agentincident.vercel.app/i/AIR-2026-0159/ (accessed 2026-10-19).