Old Unix Symlink Trick Lets Malicious Code Bypass User Checks
Recent findings by cybersecurity researchers have revealed a troubling vulnerability within six popular artificial intelligence (AI) coding assistants. This exploit allows malicious code to bypass user checks by tricking the AI tools into approving edits to sensitive files while displaying the name of an innocuous file instead. The pattern identified by the researchers has been termed "GhostApproval."
The issue stems from the way symbolic links, or symlinks, function in Unix-based systems. A symlink is a file that serves as a reference to another file located elsewhere in the system. If an application writes to a symlink without verifying its actual destination, the write operation can occur on the real target file instead, which could lead to dire security implications.
In a demonstration of this flaw, researchers from Wiz created a code repository that included a symlink named project_settings.json. Instead of directing to a legitimate project configuration file, this symlink pointed to the SSH credentials of the developer, which are critical for remote access to the machine. When a developer instructed the AI coding assistant to update project_settings.json, the assistant unknowingly executed a command that inserted a malicious SSH key into the developer’s credential file. This action granted the attacker ongoing, password-free access to the system. Additionally, in another variant of the attack, the assistant modified a shell startup file, causing harmful code to execute automatically the next time the terminal was launched.
The researchers tested this GhostApproval technique against multiple coding tools, including Amazon’s Q Developer, Claude Code from Anthropic, Augment, Cursor, Google’s Antigravity, and Windsurf. Each tool exhibited some variant of the vulnerability, with differing degrees of severity. Alarmingly, some of the AI tools wrote to the sensitive file without showing any prompts for user approval beforehand.
Importantly, the internal logic of many of these AI assistants recognized where the write operations were destined, but the approval dialogs presented only the misleading, harmless-looking file name. Maor Dokhanian, a researcher at Wiz, remarked on this fundamental flaw in the user interface, emphasizing that the AI’s reasoning did not align with what was displayed to the developer, leading to a dangerous misunderstanding. This misrepresentation of information undermines the user’s ability to make an informed decision regarding the write operation.
The case of Anthropic’s Claude Code serves as a stark illustration of this issue. During testing, the AI agent displayed a prompt requesting permission to edit project_settings.json, although its internal reasoning indicated that this file was actually a startup script for the Z shell (zsh), which would execute whenever a terminal session was initiated. Upon reporting this vulnerability in February, Anthropic contended that the exploit fell outside the predefined categories of attacks their product was built to mitigate, concluding that developers who trust a directory and accept prompts assume responsibility for their actions. Eventually, Anthropic updated Claude Code to mitigate the flaw, ensuring that symlinks are resolved and warnings are issued before sensitive writes occur. They clarified that this fix, delivered prior to the report from Wiz, was a part of a broader security enhancement rather than a direct response to the findings.
On the other hand, Amazon, Cursor, and Google quickly acknowledged the severity of the vulnerability and released patches. Amazon addressed the issue in version 1.69.0 of its editing features, tagging it as CVE-2026-12958. Cursor implemented a fix in version 3.0, crediting Wiz and Cato AI Labs for identifying similar symlink vulnerabilities. Google rectified the flaw in Antigravity with an update in May. Despite these corrective actions, Augment and Windsurf acknowledged the report but had yet to release any fixes at the time of the report.
The findings from Wiz aren’t isolated, as the pattern has been recognized by Adversa AI, which published related work in May. This group tested comparable symlink vulnerabilities across several tools, including those assessed by Wiz, and articulated similar concerns about the inherent weaknesses in user approval processes when it comes to file writing.
Wiz ultimately frames GhostApproval as a broader design challenge for the AI coding industry rather than as an individual vendor’s bug. They assert that effective security controls only work if users can see and understand what they are approving. Failing to present correct information can turn user approval into a mere formality, lacking genuine decision-making. To bolster security, Wiz recommends that AI coding tools should always resolve symlinks before displaying prompts, flag writes that take place outside of the appropriate project workspace, and should refrain from writing to disk until explicit authorization from the developer has been given.
The implications of these findings underscore the need for improved user interface design and robust security measures within AI-assisted coding environments to safeguard sensitive information from potential threats.