Wiz researchers found a nasty trick that works against six popular AI coding assistants. A malicious repo can use symbolic links to quietly overwrite your SSH keys or shell config files — and the approval box shows you the wrong thing.
They call it GhostApproval. Here’s how it works.
A symlink named project_settings.json actually points to ~/.ssh/authorized_keys. The AI assistant asks permission to edit project_settings.json. You click Accept, thinking you’re approving a harmless config change. The write goes straight to your SSH login file instead.
From there, if SSH is running, the attacker can log in with no password. A second variation targets ~/.zshrc — no SSH needed. The shell executes the malicious config next time you open a terminal.
The affected tools: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.
Some of these tools are worse than others. Windsurf writes the file to disk before the Accept and Reject buttons even appear — the prompt is basically an undo button, not a gate. Augment shows no dialog at all; Wiz demonstrated it silently reading an AWS credential file outside the project.
Three vendors have shipped fixes. Amazon Q Developer is patched in Language Server 1.69.0 (CVE-2026-12958). Cursor fixed it in v3.0 (CVE-2026-50549). Google Antigravity is also fixed. Augment and Windsurf have acknowledged the issue but haven’t patched yet. Anthropic disputes that it’s a bug in Claude Code.
Wiz’s key point: the symlink is just the delivery method. The real failure is the approval box lying to the human. Claude Code’s own internal reasoning correctly identified that the symlink pointed to a zsh config file, but the UI only showed the symlink name.
No real-world attacks have been observed yet. But the research makes clear that trusting an AI coding assistant on untrusted repos is risky right now.
