GhostApproval: Symlink Flaw Lets Six AI Coding Assistants Hijack Developer Machines
Wiz discovered GhostApproval, a symlink‑based trust‑boundary flaw affecting Amazon Q, Anthropic Claude, Augment, Cursor, Google Antigravity and Windsurf. The bug lets malicious repos trick the agents into writing files outside the workspace, enabling remote code execution on a developer’s machine. Three vendors have patched it; the others remain vulnerable.