CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

GhostApproval

tool · tool:ghostapproval-ai-coding-assistant-symlink

Wiz Research's name for a symlink-following (CWE-61) + confirmation-dialog UI-misrepresentation (CWE-451) vulnerability pattern across six AI coding assistants (Amazon Q Developer, Cursor, Google Antigravity, Augment, Windsurf, Anthropic Claude Code) letting a malicious repository write outside the workspace sandbox; CVE-2026-12958 (AWS), CVE-2026-50549 (Cursor) (Wiz Research, 2026-07-08).

Coverage
2
1 about it · 1 mention · first 2026-07-09 → last 2026-07-11
Latest activity
2026-07-09
Wiz "GhostApproval": malicious repos escape the workspace sandbox of six AI coding assistants via symlink +…
Peak priority
notable
1 notable
Targets
technology
sectors: technology, public-sector, finance
Sources cited
5
4 hosts
2026-07-092 appearances2026-07-11

Action items (2)

Do-now tasks recorded on the entries about GhostApproval, newest first. Check the date before acting on an older one.

  • Patch AWS language-servers to ≥ 1.69.0 (@aws/lsp-codewhisperer ≥ 0.0.117) and Cursor to ≥ 3.0 now; for Augment and Windsurf, restrict use against untrusted/external repositories until a fix ships.
    2026-07-09CVE-2026-12958 +1
  • Alert on any AI-coding-assistant agent process writing to credential/dotfile paths (~/.ssh/*, shell rc files, cloud-credential files) and on git-clone operations that create symlinks resolving outside the repository root.
    2026-07-09CVE-2026-12958 +1

Defender insights

What each entry about GhostApproval tells a defender to do, newest first.

2026-07-09NOTABLEWiz "GhostApproval": malicious repos escape the workspace sandbox of six AI coding assistants via symlink + fake confirmation dialog

Story timeline

Every entry that names GhostApproval, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-07-11'Friendly Fire': prompt injection hijacks AI coding agents' defensive auto-review into remote code execution
    mentionresearchAI Now Institute PoC turns an untrusted library's own files into RCE when Claude Code or Codex CLI review it in auto-mode, no hooks or config needed
  2. 2026-07-09GhostApproval (CVE-2026-12958, CVE-2026-50549), symlink + confirmation-UI misrepresentation lets a malicious repo write outside six AI coding assistants' workspace sandbox
    trending-vulnerabilitiesWiz "GhostApproval": malicious repos escape the workspace sandbox of six AI coding assistants via symlink + fake confirmation dialog

Hunting pivots

CVEs
CVE-2026-12958CVE-2026-50549
Tags
ai-abusepatch-availablepoc-publicrcesupply-chainvulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • Defense ImpairmentFile and Directory Permissions Modification
  • Credential AccessUnsecured Credentials: Private Keys

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-07-09/ghostapproval-ai-coding-assistant-symlink-trust-boundary · ATT&CK page ↗

Defense Impairment TA0112

T1222File and Directory Permissions Modification×1

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Evidence: 2026-07-09/ghostapproval-ai-coding-assistant-symlink-trust-boundary · ATT&CK page ↗

Credential Access TA0006

T1552.004Unsecured Credentials: Private Keys×1

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Evidence: 2026-07-09/ghostapproval-ai-coding-assistant-symlink-trust-boundary · ATT&CK page ↗

Entries about GhostApproval (1)

2026-07-09 · view entry permalink →

NOTABLECVE-2026-12958 +1

Wiz Research published GhostApproval on 8 July, a systematic vulnerability pattern combining CWE-61 (symbolic-link following) with CWE-451 (UI misrepresentation of critical information) found, in varying severity, across six AI coding assistants: Amazon Q Developer, Cursor, Google Antigravity, Augment, Cognition Labs' Windsurf and Anthropic's Claude Code (Wiz Research, 2026-07-08). A malicious repository plants a symlink inside the workspace that resolves to a sensitive path outside it, e.g. a file named project_settings.json that is actually a link to ~/.ssh/authorized_keys, then a README or prompt instructs the agent to "update" the file. In several tools the agent's own reasoning identifies the true target, yet the confirmation dialog still shows the harmless in-workspace name, so the user rubber-stamps a write to the real target, enabling persistent passwordless SSH access or other host compromise. Windsurf exhibited a pre-authorization write; the file was modified on disk before the Accept/Reject buttons even rendered, making the prompt an "undo" button rather than a gate.

AWS assigned CVE-2026-12958 (missing symlink validation in Language Servers for AWS, CVSS 8.5, fixed in language-servers 1.69.0 / @aws/lsp-codewhisperer 0.0.117) and Cursor assigned CVE-2026-50549 (sandbox escape via symlink + failed path canonicalization, fixed in Cursor 3.0), both confirming arbitrary out-of-workspace file write as the impact (AWS GHSA-6v3r-4p5c-mrp5, 2026-06-23; Cursor GHSA-3v8f-48vw-3mjx, 2026-06-05). Google fixed Antigravity (CVE pending at publication). Augment and Windsurf acknowledged the report but were still testable-vulnerable at disclosure (Wiz Research, 2026-07-08). Anthropic assessed the report as outside its threat model for Claude Code (its stated rationale is that a user who starts a session in a directory has already extended trust to it) while noting it had shipped a symlink warning in the Edit/Write permission dialog in v2.1.32 (5 Feb 2026) as unrelated proactive hardening (Wiz Research, 2026-07-08). Mapped to T1195.002 Compromise Software Supply Chain, T1222 File and Directory Permissions Modification (via symlink) and T1552.004 Unsecured Credentials (authorized_keys write).

The user approves what they believe is a harmless local edit; the agent writes to a sensitive file outside of the project workspace.

Wiz Research 2026-07-08

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary.

AWS GitHub Security Advisory (GHSA-6v3r-4p5c-mrp5) 2026-06-23

A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution.

Cursor GitHub Security Advisory (GHSA-3v8f-48vw-3mjx) 2026-06-05
vulnerability09 Jul 04:32Zmulti-sourceOpen finding →
Sources: Wiz Research · AWS GitHub Security Advisory (GHSA-6v3r-4p5c-mrp5) · Cursor GitHub Security Advisory (GHSA-3v8f-48vw-3mjx)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1
  • Research1

Source distribution

  • github.com2 (40%)
  • ainowinstitute.org1 (20%)
  • infosecurity-magazine.com1 (20%)
  • wiz.io1 (20%)
All cited sources (5)