Symlink Trick Lets Six AI Coding Assistants Write Outside Your Workspace
Wiz researchers uncovered GhostApproval, a symlink‑based vulnerability affecting Amazon Q, Anthropic Claude, Augment, Cursor, Google Antigravity and Windsurf. A malicious repo can trick the assistant into editing arbitrary system files while the user sees a harmless path, enabling remote code execution on the developer’s machine. Vendors have fixed three tools, others remain vulnerable.