● Covered by 4 sources · 4 reportsMedium impact1 negative
Symlink Vulnerability in AI Coding Assistants Poses Security Threat
Key points
- Six AI coding assistants are affected.
- The symlink vulnerability is a decades-old issue.
- Three out of six affected tools have shipped fixes.
- Anthropic disputes the classification as a bug.
- GhostApproval attack publicly disclosed by Wiz.
- Wiz published GhostApproval on July 8.
- GhostApproval uses a symlink named project_settings.json pointing to ~/.ssh/authorized_keys.
- GhostApproval instructs the assistant to add an attacker's SSH key to project_settings.json.
Vulnerability Identified in AI Coding Assistants
A new vulnerability called GhostApproval has been identified in six popular AI coding assistants. The flaw allows attackers to execute code via booby-trapped repositories, posing a security threat.
Affected tools include Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Researchers at Wiz reported the findings.
Exploitation Through Symbolic Links
The vulnerability exploits a Unix feature known as symbolic links, enabling attackers to redirect file writes to sensitive locations. This technique, although longstanding, remains a potent threat.
A symlink used in a malicious repository might appear benign but could point to sensitive files, letting unauthorized code execution occur unnoticed by the user.
Response and Controversy
Three of the six affected tools have issued fixes, but Anthropic challenges the classification as a vulnerability. Public awareness of GhostApproval may pressure more vendors to act.
The attack highlights the importance of scrutinizing AI tools for older, less obvious vulnerabilities like symlinks that can be overlooked.
Implications for Developers and Security
The exposure of symlink vulnerabilities in AI assistants underscores the need for enhanced security protocols and vigilant review processes.
Developers and teams using AI coding tools are advised to update affected software promptly and consider additional safeguards against similar exploits.
Updates
- Wiz published GhostApproval on July 8.
- GhostApproval uses a symlink named project_settings.json pointing to ~/.ssh/authorized_keys.
- GhostApproval instructs the assistant to add an attacker's SSH key to project_settings.json.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cursor/cursor CVE CVE-2026-129587.8 HIGH CVE CVE-2026-505499.8 CRITICAL CVE CVE-2026-129577.8 HIGH CVE CVE-2026-552008.1 HIGH CVE CVE-2026-468179.8 CRITICALHow outlets covered it
Noma Security discovered a prompt injection exploit, dubbed GitLost, that tricks GitHub's Agentic Workflows into publicly revealing private repository data. This vulnerability allows attackers to embed hidden instructions in public GitHub issues, bypassing security measures and causing AI agents to disclose confidential information in public comments. The exploit highlights a systemic security flaw in agentic AI systems, comparable to SQL injection vulnerabilities in web applications, necessitating new defense strategies.
Researchers unveiled a vulnerability named 'Ghostcommit' that allows attackers to conceal malicious commands in PNG images within code repositories. This exploitation takes advantage of a lack of substantive review in pull requests, allowing secrets to be extracted without detection by human reviewers or automated bot systems.
AI coding assistants were compromised through the GhostApproval attack, exploiting long-known symlink vulnerabilities. This raises serious security concerns about how these tools handle user confirmations and permissions, potentially leading to remote code execution.
Researchers identified vulnerabilities in six AI coding assistants that could allow malicious repositories to run arbitrary code on developers' machines. Exploiting symbolic links, attackers can manipulate the approval process of these tools, bypassing the user's consent and potentially leading to unauthorized access to sensitive files.