AI Assistance Platform Vulnerability - GhostApproval

Muskan Gohil
Jul 15
2 min read

The disclosure of GhostApproval, a vulnerability pattern affecting Amazon Q Developer, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf, marks another turning point in how we think about AI‑assisted development.

This one is big because it breaks the trust boundary between developers and their AI coding assistants.

Attack Summary:

GhostApproval exploits a classic Unix weakness (symlink following) combined with misleading UI prompts.

The result? Developers think they’re approving a harmless file change, BUT the AI assistant is actually writing to a sensitive system file outside the workspace.

What Does This Mean:

AI assistants silently resolving symlinks to ~/.ssh/authorized_keys
Attacker SSH keys being added without credentials
Shell configuration files overwritten
Arbitrary file writes leading to remote code execution
Human-in‑the‑Loop safeguards completely bypassed

- Worst of all : Some AI agents recognised the danger internally — but still showed the user a safe‑looking filename.

That’s Ghost Approval in a nutshell: Approval without informed consent.

Why This Matters:

For years, developer security models assumed:

- The workspace is trusted

- File operations are transparent

- User approval = safety

- AI assistants only modify what the user sees

GhostApproval shows us a new reality.

Latest AI Can Dos (as per this attack chain):

AI can follow symlinks into sensitive system paths
AI can misrepresent file destinations in UI prompts
AI can execute file writes before showing confirmation
AI can bypass workspace isolation
AI can unintentionally grant persistent remote access

Affected Vendor Responses:

Google - acknowledged and patched
Amazon Q - acknowledged and patched (CVE‑2026‑12958)
Cursor - acknowledged and patched (CVE‑2026‑50549)
Claude Code - initially rejected, later mitigation steps added such as symlink warnings
Augment & Windsurf - acknowledged but incomplete fixes