Vulnerability in coding agents: access to arbitrary files via symlinks

A security vulnerability exists in six major coding agents: via a repository with malicious code, attackers can trick the AI models into accessing arbitrary files -- even outside a sandbox.

IT researchers from Wiz discovered the vulnerability and named it GhostApproval. The vulnerability lies in the handling of symbolic links.

Affected are Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Updates that fix the vulnerability are now available for most tools, but patches for Augment and Windsurf do not yet exist.

Apparently, the affected agents do not sufficiently check the symlinks. The Wiz researchers have created a repository that contains the symlink project_settings.json, which points to the SSH keys (~/.ssh/authorized_keys).

The Readme file contains the instruction that the assistant should add a line to project_settings.json when setting up a workspace. This line contains the attacker's SSH key.

As soon as someone hands over the repository to an AI agent with the request to set up a workspace for it, the agent seemingly writes to the harmless project_settings.json file, which is not a project file but a symlink to the SSH keys. This opens up SSH access for the attacker.

Wiz has also successfully tested a variant of the attack that uses a symlink to the shell's startup file ~/.zshrc.

Particularly fatal: Those who rely on security through Human in the Loop could be deceived. For example, Claude Code recognizes in its internal reasoning that project_settings.json is actually a zsh configuration file. However, the assistant conceals this information in the dialogue and only asks “Make this edit to project_settings.json?”

Other tools bypass human interaction even further: Windsurf first writes the SSH key to the file and then asks if it's okay. Augment shows no dialogue at all.

The researchers discovered the vulnerability in February 2026 and reported it to the manufacturers. Updates are now available for Amazon Q Developer, Google Antigravity, and Cursor that no longer have the problem. Augment and Windsurf are working on it. According to Anthropic, they were working independently of the Wiz investigation to ensure Claude Code recognizes and warns symlinks.

Further details on the vulnerabilities and how they manifest in individual AI agents can be found in the Wiz blog. Find more details in the Wiz blog .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.