Six popular AI coding assistants, including Amazon Q Developer and Anthropic's Claude Code, have been found vulnerable to an attack that can grant attackers SSH access to a developer's machine. The flaw, named GhostApproval, tricks users into approving seemingly harmless file changes that actually modify critical system files.
TL;DR
- Six AI coding tools vulnerable to GhostApproval attack enabling SSH access without user awareness.
- Attack exploits symlinks to deceive users into approving malicious file changes.
- Three tools patched, two acknowledged but unpatched, one disputed the vulnerability.
What happened
Security research firm Wiz discovered that six widely used AI coding assistants can be manipulated to write attacker-controlled SSH keys to a developer's machine. The attack, dubbed GhostApproval, exploits symbolic links (symlinks) to deceive users into approving seemingly innocuous file changes that actually modify critical system files.
The affected tools are Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack vector involves a malicious repository containing a symlink that targets a critical system file, such as ~/.ssh/authorized_keys. When the AI assistant follows the symlink, the attacker's SSH public key is added to the developer's authorized keys, granting persistent remote access.
Wiz filed its first vendor reports in February 2026 and completed the coordinated disclosure round by early March. As of July 8, 2026, three tools have been patched, two have acknowledged the issue but have not yet released fixes, and one disputed the vulnerability.
Why it matters
The GhostApproval flaw highlights a significant security gap in AI coding assistants, where the approval dialog shown to the user does not accurately reflect the actual file being modified. This decoupling of the approval display layer and the agent's internal reasoning chain renders the 'human-in-the-loop' security model ineffective.
For developers and startups, this vulnerability underscores the importance of regularly updating AI coding tools and exercising caution when working with unfamiliar repositories. Investors should be aware of the potential security risks associated with AI-assisted coding workflows and the need for robust security measures in these tools.
The competitive angle is that this vulnerability affects a significant portion of the professional developer population using AI-assisted coding workflows. The disparate vendor responses also highlight the varying approaches to security and transparency among AI tool providers.
Key facts
- Affected tools: Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.
- Attack vector: Exploits symlinks to deceive users into approving malicious file changes.
- Patched tools: Amazon Q Developer (version 1.69.0), Cursor (version 3.0), Google Antigravity (version 1.19.6).
- Acknowledged but unpatched: Augment and Windsurf.
- Disputed vulnerability: Anthropic's Claude Code.
- Attack infrastructure: Miasma worm campaign has been using similar techniques since June 1, 2026.
- Recommended actions: Update to patched versions, avoid untrusted repositories, use containers or sandboxes, review repository instructions, and check file timestamps.
Context
The GhostApproval vulnerability is not an isolated incident. In May 2026, Adversa AI published a separate disclosure called SymJack, which tested the same symlink-based approval-prompt spoofing technique against six AI coding tools, including Claude Code, Cursor, GitHub Copilot, xAI's Grok Build, Gemini CLI, and OpenAI Codex. All six were vulnerable.
Three independent research teams have now identified the same structural weakness in AI coding assistants, suggesting a category-wide design challenge rather than isolated implementation bugs. This highlights the need for a more robust security model in AI-assisted coding workflows.
The Miasma worm campaign, attributed to the threat group TeamPCP, has been actively using similar techniques to compromise developer environments. This underscores the real-world relevance of the GhostApproval vulnerability and the need for immediate action to mitigate the risk.