{"id":14174,"date":"2026-07-09T10:03:39","date_gmt":"2026-07-09T10:03:39","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/09\/new-ghostapproval-vulnerability-affects-amazon-q-claude-code-cursor-and-other-ai-agents\/"},"modified":"2026-07-09T10:03:39","modified_gmt":"2026-07-09T10:03:39","slug":"new-ghostapproval-vulnerability-affects-amazon-q-claude-code-cursor-and-other-ai-agents","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/09\/new-ghostapproval-vulnerability-affects-amazon-q-claude-code-cursor-and-other-ai-agents\/","title":{"rendered":"New GhostApproval Vulnerability Affects Amazon Q, Claude Code, Cursor, and Other AI Agents"},"content":{"rendered":"

New GhostApproval Vulnerability Affects Amazon Q, Claude Code, Cursor, and Other AI Agents
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly disclosed vulnerability pattern dubbed \u201cGhostApproval\u201d has exposed a critical security flaw in six of the most widely used AI coding assistants: Amazon Q Developer, Anthropic Claude Code<\/a>, Augment, Cursor, Google Antigravity, and Windsurf, allowing malicious repositories to bypass Human-in-the-Loop safety controls and potentially achieve remote code execution on developer machines.<\/p>\n

Discovered by Wiz researchers, GhostApproval exploits a deceptively simple but deeply impactful technique: symbolic link following (CWE-61<\/a>).<\/p>\n

A symlink is a filesystem pointer that makes one path silently resolve to another. While this primitive has been exploited for decades in Docker escapes (CVE-2024-21626<\/a>), npm package managers (CVE-2021-32803<\/a>), and Linux privilege escalation, its application to AI coding agents represents a novel and systematic attack surface.<\/p>\n

The attack is elegantly simple. An attacker creates a malicious repository containing a symlink<\/a>, for example, project_settings.json<\/code> \u2192 ~\/.ssh\/authorized_keys<\/code>.<\/p>\n

\"\"
GhostApproval Attack (Source: Wiz)<\/figcaption><\/figure>\n

When a victim clones the repo and asks their AI coding assistant to \u201cset up the workspace,\u201d the agent follows the symlink and writes the attacker\u2019s SSH public key directly to the victim\u2019s authorized_keys<\/code> file. The result: persistent, password-less SSH access to the developer\u2019s machine.<\/p>\n

What elevates GhostApproval beyond a straightforward symlink exploit is the UI misrepresentation layer (CWE-451<\/a>). The most striking example was observed in Anthropic\u2019s Claude Code.<\/p>\n

\n
\"\"
GhostApproval Anthropic\u2019s Claude Code (Source: WIZ)<\/figcaption><\/figure>\n<\/div>\n

During testing, the agent\u2019s internal reasoning explicitly stated: \u201cI can see that project_settings.json is actually a zsh configuration file.\u201d<\/em> Yet the confirmation prompt displayed to the user simply asked: \u201cMake this edit to project_settings.json?\u201d<\/em><\/p>\n

The agent knew the true target. The user did not. This transforms a sandbox bypass into an informed consent bypass; the Human-in-the-Loop safety net becomes a rubber stamp.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n
Vendor<\/th>\nSeverity<\/th>\nCVE<\/th>\nFixed Version<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
Amazon Web Services<\/td>\nHigh<\/td>\nCVE-2026-12958<\/td>\nLanguage server v1.69.0<\/td>\nFixed<\/strong><\/td>\n<\/tr>\n
Google (Antigravity)<\/td>\nCritical<\/td>\nPending<\/td>\nv1.19.6<\/td>\nFixed<\/strong><\/td>\n<\/tr>\n
Cursor<\/td>\nCritical<\/td>\nCVE-2026-50549<\/td>\nv3.0<\/td>\nFixed<\/strong><\/td>\n<\/tr>\n
Augment<\/td>\nCritical<\/td>\n\u2014<\/td>\nv0.754.3<\/td>\nIn Progress<\/td>\n<\/tr>\n
Windsurf<\/td>\nCritical<\/td>\n\u2014<\/td>\nv1.9566 (tested)<\/td>\nIn Progress<\/td>\n<\/tr>\n
Anthropic (Claude Code)<\/td>\nDisputed<\/td>\n\u2014<\/td>\nv2.1.42<\/td>\nRejected \/ Patched<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Three vendors patched the vulnerability promptly: AWS, Cursor, and Google. AWS fixed the issue in language server version 1.69.0 (deployed May 27, 2026) and assigned CVE-2026-12958.<\/p>\n

The update ships automatically, and customers can trigger it by reloading their IDE. Cursor released its fix in v3.0 (June 5, 2026) under CVE-2026-50549. Google deployed its fix on May 22, 2026, and is assessing whether to issue a CVE.<\/p>\n

Augment and Windsurf acknowledged the reports but provided no further updates at the time of Wiz publication. Windsurf\u2019s pre-authorization variant was particularly dangerous: the agent writes to disk before<\/em> the Accept\/Reject dialog appears, meaning the confirmation dialog functions as an undo button rather than an authorization gate.<\/p>\n

Anthropic initially rejected the report as \u201coutside our threat model,\u201d arguing that user-trusted directories and user-approved prompts place responsibility on the user. However, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files.<\/p>\n

Anthropic later clarified with Wiz that this symlink warning shipped in v2.1.32 on February 5, 2026 \u2014 nine days before the report was submitted as part of proactive internal security hardening.<\/p>\n

Wiz researchers outlined<\/a> three core mitigations for AI coding tool vendors:<\/p>\n