GhostApproval Symlink-Based File Write Confusion in AI Coding Agents

Technical Analysis

The attack works by planting a symbolic link inside a code repository so that a filename presented to the AI agent's approval UI (e.g., a benign config file) actually resolves to a different, sensitive path on disk (such as a shell profile, SSH config, or agent settings file). When the developer approves the agent's proposed file edit, the underlying file write follows the symlink rather than the displayed path, letting the attacker overwrite security-relevant files without further consent. This crosses the human-in-the-loop trust boundary: the approval dialog is meant to constrain agent actions, but path resolution happens after the trust decision is made, enabling privilege escalation and potential arbitrary code execution when the overwritten file is later executed or sourced. The flaw is a design/logic issue in how the affected tools validate and display file paths prior to writes, not a model-level prompt injection, though a malicious repo could pair it with adversarial file/README content to increase the odds the agent proposes the trapped edit.

Affected Systems

Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf

Detection Signatures

• Symlinks present in cloned/untrusted repositories pointing outside the project directory
• File write operations by AI coding agents targeting paths outside the workspace root
• Discrepancy between the path shown in an agent's approval prompt and the actual resolved filesystem path
• Repository content with unusual or hidden symlink files (e.g., disguised as config, .env, or README-adjacent files)
• Unexpected modifications to shell profiles, SSH configs, or agent settings files shortly after opening a new project in an AI coding assistant

Remediation Steps

1. 1

   Resolve real paths before approval

   Agents should canonicalize (resolve symlinks) and display the true target path in approval prompts, not the apparent path, before any file write occurs.

2. 2

   Restrict writes to workspace boundary

   Enforce that file writes triggered by agent actions cannot resolve to paths outside the project/workspace root, rejecting or flagging symlinks that escape the sandbox.

3. 3

   Update affected tools

   Apply vendor patches for Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf once released, and monitor vendor advisories for CVE assignment.

4. 4

   Treat untrusted repos as hostile

   Open unfamiliar or third-party repositories in isolated/sandboxed environments (containers, VMs) when using AI coding agents, especially before granting any file-edit approvals.

5. 5

   Audit symlinks pre-ingestion

   Scan cloned repositories for symlinks pointing outside the repo directory before allowing an AI agent to operate on them.