Vulnerabilities & Exploits · Supply Chain

Approval Boxes Are the New Attack Surface

AI coding assistants can be made to lie about what they are changing, so a human click no longer means the write stayed in the workspace. The broken boundary is the approval screen itself: a repo can point a harmless-looking file name at a sensitive local target and turn routine consent into overwrite access to SSH keys or shell startup files.

Wiz says GhostApproval affects Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, Google Gemini, and Windsurf. Three vendors have shipped fixes, two have not, and Anthropic disputes the finding; Wiz also says the pattern can lead to code execution on the developer machine.

This shifts the issue from a single sandbox-escape claim to a broader trust failure across popular assistants. If the tool can edit files after approval, the user prompt is no longer a reliable gate on filesystem writes.

5 sources · Jul 9

Timeline

• Jul 9 Reported by Infosecurity Magazine
• Jul 8 Reported by The Register Security

Sources

• Jul 9 Infosecurity Magazine

  GhostApproval Flaw Hits Six Major AI Coding Assistants

  Wiz discovered GhostApproval, a symlink flaw in six major AI coding assistants that bypasses approval

  original

• Jul 9 The Hacker News

  GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

  Wiz says GhostApproval abuses symlinks so AI coding agents write to SSH keys or shell startup files while showing benign paths.

  original

• Jul 9 SecurityWeek

  AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique

  Wiz has disclosed the details of a new AI coding assistant attack method it has dubbed GhostApproval.

  original

Part of the PlainSec briefing for 2026-07-08

Every edition of this story: Approval Boxes Are the New Attack Surface

More from today

• Roundcube Makes University Mail a Foothold
• Routers Become Shared Cover for Espionage
• Guest Root Can Break KVM Host Isolation