GhostApproval symlink flaw lets AI coding assistants including Claude Code and Cursor hand attackers SSH access, Wiz Research finds
A symlink trick called GhostApproval can make AI coding assistants write an attacker's SSH key into a developer's real key file, handing over remote access. Wiz found it in six tools including Claude Code and Cursor. Cursor, Amazon Q and Google patched; Anthropic disputes it is a
Developers using half of the six major AI coding assistants are exposed to a trick that can hand an attacker passwordless remote access to their machine, according to research from Wiz. The flaw, named GhostApproval, exploits symbolic links, file paths that secretly resolve to a different location than the name suggests. In Wiz's proof of concept, a symlink inside a code repository was disguised as an innocent file such as project_settings.json but actually pointed at the developer's SSH keys. When the developer asked the AI assistant to set up the workspace or follow the project's README, the agent followed the link and wrote an attacker-supplied key into the real target file, handing over remote access without a password. The research found a second problem compounding the first: in several cases, the assistant's internal reasoning correctly identified the symlink as pointing to a sensitive file, but the confirmation prompt shown to the developer did not disclose that detail, so the developer approved an action they could not fully evaluate. Wiz tested six tools: Amazon Q Developer, Claude Code, Cursor, Google Antigravity, Augment and Windsurf. Amazon Q, Cursor and Google Antigravity have shipped fixes. Anthropic has disputed that Claude Code's behavior constitutes a vulnerability, arguing that a developer who trusts a project's directory is responsible for their own approval decisions. Augment and Windsurf status was not detailed in available reporting. Per Wiz Research and Infosecurity Magazine.