AI coding agents expose GhostApproval sandbox bypass | Let's Data Science

The Register reported on July 8, 2026 , that Wiz disclosed GhostApproval , a symlink-based vulnerability pattern affecting at least six AI coding assistants and potentially enabling remote code execution outside a workspace sandbox. The issue matters because coding agents increasingly combine file access, command execution, and human approval prompts, so old path-resolution bugs can become agent-control failures. The Register says Wiz reported the pattern to Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. It says Amazon/AWS, Cursor, and Google treated the issue as critical or high-severity and issued or began CVE tracking, while Augment, Windsurf, and Anthropic had not fully remediated it at publication.

GhostApproval is a useful warning for teams adopting coding agents because the control failure is not exotic: a familiar symlink and path-resolution class of bug becomes more dangerous when an agent can read files, run commands, and ask users to approve actions that look local. The practical takeaway is that agent sandboxes need boring, strict filesystem controls before they are trusted with production repositories or cloud credentials.

The Register reports that Wiz found a vulnerability pattern it named GhostApproval across at least six AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. According to that report, the pattern can trick an assistant into following symlinks outside the intended workspace and can lead to remote code execution on a developer machine.

The important security boundary is path canonicalization before an agent reads, writes, or executes anything. If a tool treats a symlinked path as safe because it appears inside the workspace, a human approval prompt can become misleading: the user thinks they are approving an in-project action while the agent may be touching an external file.

Teams should inventory which coding assistants have repository, shell, credential, or local filesystem access, then verify whether each vendor has shipped a fix for symlink traversal and approval-flow bypasses. Defensive controls should include narrow workspace mounts, explicit deny rules for sensitive directories, network egress logging, and tests that try to traverse symlinks before agent tools are allowed in sensitive environments.

The story is still concentrated in one publisher, so vendor advisories matter. Watch for CVE records from AWS, Cursor, Google, or Wiz, and for whether unpatched vendors change threat models, approval prompts, or sandbox defaults after disclosure.

This is notable for AI and software teams because the reported pattern spans multiple widely used coding assistants and can affect local workstation safety. Sourcing is still concentrated in one publisher and public vendor advisories are not yet prominent, so it remains below the major-impact range.

Public references used for this report.

Practice interview problems based on real data

1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.