GhostApproval in AI Assistants: symlink can spoof approval and write code into sensitive files

Colleagues, I’d like to flag a cybersecurity topic.

Wiz has described GhostApproval: a malicious repository can use a symlink to alter what an AI coding assistant displays in the approval window.

As a result, the assistant appears to request a change to a harmless file, while the write operation lands in ~/.ssh/authorized_keys or ~/.zshrc.

Affected tools include Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Some have already been patched; others have not.

Why it matters: a “human in the loop” does not help if the approval dialog shows a false target.

I would verify README and hidden files, and run such tools only in a sandbox. How do you protect your work environment?

#cybersecurity #AI #vulnerability #DevSecOps