GhostApproval Vulnerability Exposes AI Coding Assistants to Remote Code Execution

A vulnerability named GhostApproval has been discovered in six major AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw allows malicious repositories to trick AI agents into accessing files outside their designated workspaces, potentially leading to remote code execution on developers' machines. The vulnerability exploits symbolic links (symlinks) to bypass security controls, with attackers able to write sensitive data, such as SSH keys, to unauthorized locations. Wiz reported the issue, and while Amazon, Google, and Cursor have issued patches, Augment and Windsurf have not yet remediated the vulnerability. The flaw highlights significant trust boundary gaps in AI coding tools that rely on user approval for actions. Current status indicates that while some vendors have acted, others remain vulnerable, posing a risk to enterprises utilizing these tools.

Key Points: • GhostApproval affects six major AI coding assistants, leading to potential remote code execution. • The vulnerability exploits symlinks to bypass workspace sandboxes, allowing unauthorized file access. • Patches have been issued by Amazon, Google, and Cursor, but Augment and Windsurf remain unpatched.