Definition
GhostApproval is a systematic vulnerability pattern in AI coding assistants where malicious repositories use symbolic links (symlinks, CWE-61) to trick agents into writing to sensitive files outside the workspace sandbox, while confirmation dialogs display harmless paths (CWE-451 UI misrepresentation).
Affected Tools (July 2026)
| Vendor | Status | CVE |
|---|---|---|
| Amazon Q Developer | Fixed | CVE-2026-12958 |
| Cursor | Fixed | CVE-2026-50549 |
| Google Antigravity | Fixed | Pending CVE |
| Anthropic Claude Code | Mitigated (v2.1.32+) | N/A |
| Augment | Unfixed | — |
| Windsurf | Unfixed | — |
Attack Vector
Malicious repo README instructs agent to edit a symlinked file (e.g., ./config.json → ~/.ssh/authorized_keys). Agent’s internal reasoning may recognize the dangerous target, but user sees only the symlink name in approval dialog.
Distinct from hallusquatting (hallucination-based package names).
Mitigations
- Resolve symlinks before displaying confirmation prompts
- Warn when resolved path exits workspace
- Never write to disk before explicit user authorization
- Inspect repo symlinks before cloning untrusted code
Related
- ai-security
- coding-agents
- agentic-coding-infrastructure
- supply-chain-attacks
- hallusquatting
- wiz
- sandboxing