GhostApproval affects Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, Windsurf. Malicious repos trick agents into writing outside workspace via symlinks (CWE-61) while UI shows harmless paths (CWE-451). CVE-2026-12958 (AWS, fixed), CVE-2026-50549 (Cursor, fixed), Google fixed May 22. Anthropic symlink warning in v2.1.32 (Feb 5, 2026). Augment and Windsurf in progress. PoC writes SSH key to ~/.ssh/authorized_keys.