Loading story…
Researchers at Wiz disclosed GhostApproval, a vulnerability pattern affecting at least six AI coding assistants — Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — that abuses symbolic links in malicious repositories to bypass workspace trust boundaries. The flaw can trick an agent into reading from or writing to files outside the intended project directory, creating a path to sensitive file modification, data exfiltration, persistent unauthorized access, or even remote code execution on a developer machine.
Wiz said the weakness was amplified by misleading approval flows: several tools reportedly detected the real symlink destination internally, but their prompts concealed that destination from users, weakening human-in-the-loop safeguards. Amazon, Cursor, and Google treated the issue as a serious security problem and released fixes, with Amazon assigning CVE-2026-12958 and Cursor assigning CVE-2026-50549; Google was still evaluating CVE issuance. Anthropic said the behavior was initially outside Claude Code’s threat model, though current versions reportedly warn before writing to sensitive files, while Augment and Windsurf acknowledged the report but had not announced patches at press time.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Anthropic updated Claude Code so that version 2.1.173 and later resolve symbolic links, addressing the GhostApproval issue in its tool. This is a remediation step beyond Anthropic's earlier response that the issue was outside the product's threat model.
Anthropic initially said the issue was outside Claude Code's threat model, though current Claude versions reportedly warn before writing to sensitive files. Augment and Windsurf acknowledged the report but had not patched at press time.
By late June, AWS, Cursor, and Google had deployed fixes for GhostApproval-related issues in their AI coding assistants. Amazon assigned CVE-2026-12958, Cursor assigned CVE-2026-50549, and Google was still assessing CVE issuance.
Wiz disclosed the issue to Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The report highlighted that confirmation prompts often hid the true symlink destination, weakening human approval safeguards.
Wiz discovered a vulnerability pattern it named GhostApproval that abuses symbolic links in malicious repositories to make AI coding assistants access files outside their workspace sandbox. The issue can enable unauthorized file writes, data exfiltration, persistent access, or remote code execution on a developer machine.
Wiz published a proof of concept for GhostApproval showing how a malicious repository could disguise a symlink as a benign project file such as project_settings.json while redirecting writes to sensitive files like SSH keys. Wiz said the technique could grant passwordless remote access and, in the worst case, lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
18 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcehackread.com
Open sourceinfosecurity-magazine.com
Open sourcescworld.com
Open sourcedecipher.sc
Open sourceadversa.ai
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026
Researchers disclosed **Ghostcommit**, a proof-of-concept software supply-chain attack that hides prompt-injection instructions inside a PNG image referenced by an `AGENTS.md` file, allowing malicious pull requests to appear benign during review. In the demonstrated scenario, AI code reviewers such as Cursor Bugbot and CodeRabbit did not meaningfully inspect image content, so the pull request could be merged even though the real instructions were concealed in the image rather than visible text. After merge, the attack is triggered when a developer later asks a coding agent to perform a routine task and the agent reads the hidden image instructions, accesses repository secrets such as the `.env` file, encodes the contents as integer tuples, and inserts them into source code in a way that can evade typical secret scanners. Researchers from the University of Missouri-Kansas City's ASSET Research Group said exploitation depended more on the coding harness than the underlying model, with Cursor and Antigravity leaking secrets across multiple models while **Claude Code** consistently refused; they reported the issue to vendors and built a multimodal GitHub review app that detected nearly all tested variants, including image-based attacks, with no false positives in their evaluation.
Jul 15, 2026
Amazon patched a high-severity flaw in **Amazon Q Developer** and the underlying **Language Servers for AWS** that allowed a booby-trapped repository to execute attacker-controlled commands when a developer opened and trusted a workspace. Tracked as **`CVE-2026-12957`** and rated **CVSS 8.5**, the issue involved unsafe handling of **Model Context Protocol (MCP)** configuration files such as **`.amazonq/mcp.json`**, which could cause Amazon Q integrations for **VS Code, JetBrains, Eclipse, and Visual Studio** to launch local processes defined by an attacker. Those processes inherited the developer’s environment, exposing **AWS credentials, API keys, authentication tokens, and SSH agent access** already present on the machine. **Wiz Research** reported the vulnerability to AWS on April 20, and AWS fixed it on May 12, later publishing an advisory and releasing remediation in **Language Servers for AWS 1.65.0**. AWS also addressed a related flaw, **`CVE-2026-12958`**, involving missing symlink validation that could enable arbitrary file writes outside the workspace trust boundary; customers were advised to upgrade to **version 1.69.0** to cover both issues. Researchers said likely attack paths include fake coding tests, typosquatted open-source packages, and malicious pull requests, while noting the weakness reflects broader trust-boundary problems emerging across AI coding assistants that adopt MCP-style workspace configuration.
Jun 29, 2026