"GhostApproval" Symlink Flaws Defeat Human-in-the-Loop in Six AI Coding Assistants

Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf

A malicious repository plants a symlink disguised as an innocuous file (for example `project_settings.json`) that points at `~/.ssh/authorized_keys` or a shell startup file. When the developer asks the agent to set up or edit the file, the agent writes attacker content through the symlink for passwordless SSH access or code execution, while the approval dialog displays the harmless presented path rather than the real target. Some tools write before approval or with no prompt at all

Agents follow symlinks with standard file operations but seek approval based on the shown path, not the resolved target (CWE-61 symlink following plus CWE-451 UI misrepresentation), so human approval is meaningless. Found by Wiz Research. Amazon (CVE-2026-12958, fixed in Language Server 1.69.0) and Cursor (CVE-2026-50549, fixed in 3.0) patched, Google fixed with a CVE pending, Augment and Windsurf were unpatched at disclosure, and Anthropic called it outside its threat model