GhostApproval Symlink Flaw Hit Six AI Coding Assistants

Wiz Research disclosed a symlink flaw called GhostApproval on July 8, and it hit six major AI coding assistants at once: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

How a filename lies to you

A repo ships a file named project_settings.json. It's actually a symlink pointing at your SSH keys. You ask the agent to "set up the workspace." The agent resolves the link, writes to the real target, and shows an approval dialog that displays project_settings.json — the name it was told, not the file it's about to touch. Approve it, and you've just authorized a write to ~/.ssh/id_rsa without knowing it. The dialog isn't broken; it shows the path a tool call was invoked with, not the path the filesystem resolves to after following a symlink — a decades-old class of bug that predates LLMs by thirty years.

Vendors split on whether it's even a bug

Amazon, Google, and Cursor shipped fixes. Augment and Windsurf went quiet. Anthropic disputed that Claude Code's behavior was a flaw at all, arguing that a user who trusts a directory and approves an edit owns that decision. The same week, Cursor separately patched DuneSlide — two CVSS 9.8 zero-click remote code execution bugs where a prompt-injected instruction in an MCP response or search result escaped the sandbox entirely, with no approval step involved at all.

Why this isn't a one-off

GhostApproval and DuneSlide put the trust boundary in the wrong place in two different ways: one relies on a human reading a dialog correctly under time pressure, the other skips the human entirely. Per-action approval was never a real architecture — it's a stopgap that asks someone to make a correct security judgment on every decision an agent generates faster than anyone can review. Nobody reviewing a routine "set up the workspace" request is mentally resolving symlinks before clicking approve, which is exactly why a defensible-in-the-abstract argument like Anthropic's is useless in practice.

The fix isn't a smarter dialog

The actual remedy is scoping what an agent can touch before it runs, not asking someone to referee each action as it happens. A spec that enumerates which paths, which operations, and which directories are in bounds for a given task turns "did the human catch this" into "was this ever a legal move" — you don't need to out-think a symlink attack if the agent was never authorized to write outside the project directory in the first place.

What to watch: whether Augment and Windsurf ship fixes for GhostApproval, and whether more agent vendors move toward defining that blast radius up front instead of leaving a dialog box to catch it after the fact.