GhostApproval Flaw Hits Six Major AI Coding Assistants
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-50549 | Cursor is a code editor built for programming with AI. Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the workspace and force canonicalization to fail — either because the target does not exist or because read permission is removed from the path — so the agent writes through the symlink to an arbitrary location without approval. A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0. NVD description · AI analysis pending | 9.3 | 1% |
| — |
Full article366 words · extracted from infosecurity-magazine.com · click to collapse
Six major AI coding assistants have been found to share a flaw that turns their approval prompts into a rubber stamp, letting a malicious repository write to sensitive files on a developer's machine and, in the worst case, achieve remote code execution.
Wiz Research named the flaw GhostApproval and found it in Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf.
The technique relies on symbolic links, or symlinks, which make one file path secretly resolve to another.
One Trusted Approval, One Hidden Target
In a proof of concept (PoC) published on July 7, Wiz showed how a symlink inside a repository, disguised as an innocent file such as project_settings.json could actually point at the developer's SSH keys.
When the developer asked the assistant to "set up the workspace" or follow the README, the agent followed the link and wrote an attacker-supplied key into the real target, handing over passwordless remote access.
Wiz said the design effectively bypasses informed consent: in several tools, the agent resolved the file to a sensitive location, yet the approval dialog showed only the harmless filename, so a developer approved an edit they could not actually see.
Read more on hijacking AI coding agents: New "Agentjacking" Attacks Could Hijack AI Coding Agents
Fixed, Silent or Disputed
In early 2026, Wiz said it reported GhostApproval to all six vendors.
Amazon, Google and Cursor treated it as a vulnerability and shipped fixes. Cursor issued CVE-2026-50549 to the the flaw.
Augment and Windsurf acknowledged the reports but, as of publication, had gone quiet without a fix, leaving their users potentially exposed.
Anthropic disputed that Claude Code's behavior was a vulnerability. It argued that a user who trusts a directory and approves an edit owns that decision, putting the scenario "outside our threat model."
Wiz framed GhostApproval less as isolated bugs than as a design question the industry has yet to settle: whether an AI coding tool should shield users from a deceptive workspace, or leave that to their judgment.
Its advice to vendors was to resolve symlinks before asking for approval and to flag any write that lands outside the project.
Developers using Augment or Windsurf, meanwhile, should watch for updates.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ghostapproval-flaw-ai-coding/