GhostApproval Vulnerability in AI Coding Assistants Allows Remote Code Execution

A vulnerability named GhostApproval has been identified in six popular AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw exploits symbolic links (symlinks) to bypass workspace sandboxes, potentially allowing remote code execution on developers' machines. The security firm Wiz reported the issue, leading to critical fixes from Amazon, Cursor, and Google, while Augment and Windsurf have not yet patched the vulnerability. Anthropic dismissed the issue as 'outside our threat model.' The vulnerability exposes enterprises that rely on AI coding tools to significant risks, as these tools often have deep access to sensitive codebases. Although no active exploitation has been reported, the potential for abuse remains high, especially in environments rushing to deploy these technologies.

Key Points: • GhostApproval affects six major AI coding assistants, risking remote code execution. • Amazon, Cursor, and Google have issued patches, while Augment and Windsurf have not. • Anthropic rejected the vulnerability report, claiming it is outside their threat model.