Here’s one for the “old tricks still work” files. Wiz researchers found a way to trick popular AI coding assistants into hacking a developer’s own machine — using a technique that’s been around since the early days of Unix.
They’re calling it GhostApproval. And it works against Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Augment, and Windsurf.
The trick is simple in concept: symbolic link following. An attacker plants a symlink in what looks like a normal repository. The link points to a sensitive location outside the workspace — system files, config, whatever. When a developer opens the repo in an AI coding assistant and asks it to make edits, the agent follows the symlink and writes to the attacker’s target instead of the workspace file.
Here’s the really nasty part. Some AI coding tools don’t show the actual canonical path in their confirmation dialogs. So a user sees “edit README.md” and approves, while the agent silently modifies /etc/passwd or something equally dangerous.
The result? Remote code execution on the developer’s machine.
“The Human-in-the-Loop security model only works if the loop provides accurate information,” the researchers note. “When an agent shows one thing and does another, user approval becomes meaningless.”
Wiz reported these findings to each vendor in Q1 2026. AWS, Google, and Cursor confirmed the issue and patched. Anthropic doesn’t view it as a vulnerability but had already added mitigations before the report. Augment and Windsurf acknowledged receipt but haven’t released fixes yet.
Wiz published the full technical deep-dive on their blog. Worth a read if you’re running any of these tools in your dev environment.
