Back Feeds.4Sysops

GhostApproval vulnerability in AI coding agents enables remote code execution

Feeds.4Sysops •IT News • July 8, 2026

A widespread vulnerability pattern named GhostApproval has been discovered in several popular AI coding assistants, including Amazon Q Developer, Cursor, and Google Antigravity. The flaw exploits a classic Unix-era security weakness involving symbolic links (symlinks) to bypass the intended workspace sandbox. By tricking an AI agent into interacting with a malicious repository, attackers can force the tool to read or write sensitive files outside the project directory. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GhostApproval Vulnerability Exposes AI Coding Assistants to Remote Code Execution A vulnerability named GhostApproval has been discovered in six major AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw allows malicious repositories to trick AI agents into accessing files outside their designated workspaces, potentially leading to remote code execution on developers' machines. The vulnerability exploits symbolic links (symlinks) to bypass security controls, with attackers able to write sensitive data, such as SSH keys, to unauthorized locations. Wiz reported the issue, and while Amazon, Google, and Cursor have issued patches, Augment and Windsurf have not yet remediated the vulnerability. The flaw highlights significant trust boundary gaps in AI coding tools that rely on user approval for actions. Current status indicates that while some vendors have acted, others remain vulnerable, posing a risk to enterprises utilizing these tools. 17 sources 71

Extracted Entities

GhostApproval vulnerability in AI coding agents enables remote code execution

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)