AI Coding Tools Can Fake Approval Prompts

Six widely used artificial intelligence coding assistants can be tricked into approving edits to sensitive files while showing users the name of a harmless file instead, researchers found.

See Also: Snyk Reportedly Cuts 90 Jobs to Accelerate AI Strategy

The flaw allows a malicious repository to trick an AI agent into writing to sensitive files such as SSH keys while the on-screen approval prompt shows the name of a harmless local file. Wiz researchers dubbed the pattern GhostApproval.

The technique exploits symbolic links, or symlinks, a Unix feature that has caused security problems for decades. A symlink is a file that looks ordinary but points to a different file elsewhere on the system. When a program writes to the symlink without checking where it truly leads, the write lands on the real target instead.

Wiz researchers created a test code repository containing a file named project_settings.json that was actually a Unix symlink. Instead of pointing to a project file, it pointed to the developer’s SSH credentials, which control remote access to the machine. The repository’s README instructed the AI coding assistant to update project_settings.json. When the developer asked the assistant to set up the project, it followed the shortcut and wrote the attacker’s SSH key into the SSH credentials file instead, giving the attacker persistent, password-free access. In another version of the attack, the assistant modified a shell startup file, causing malicious code to run automatically the next time the developer opened a terminal.

Wiz tested the technique against Amazon Q Developer, Anthropic’s Claude Code, Augment, Cursor, Google Antigravity and Windsurf, and found some version of the flaw in each one, with varying severity. Some tools wrote the file to disk before showing any approval prompt at all.

The deeper problem beyond the symlink is that in several tools, the agent’s internal reasoning correctly identified the true destination of the write but the confirmation dialog shown to the developer named only the fake, harmless-looking file. Wiz researcher Maor Dokhanian said that the agent recognized the file as something other than what it claimed to be in its own output and wrote the malicious payload anyway. Wiz classifies this second failure separately as a user interface flaw that misrepresents critical information to the person meant to be approving the action.

Anthropic’s Claude Code produced the clearest example, Wiz said. During testing, the agent’s reasoning showed the file in question was actually a startup file for zsh, a common command-line shell, meaning it would run automatically whenever the developer opened a terminal. The prompt shown to the developer simply asked whether to edit project_settings.json. When Wiz reported the issue in February, Anthropic replied that the scenario fell outside the set of attacks the product is designed to defend against, adding that a developer who trusts a directory and approves a prompt inside it bears responsibility for that decision. Anthropic closed the report without committing to a fix.

Wiz later found that current versions of Claude Code, 2.1.173 and above, resolve symlinks and warn users before writing to sensitive files. Anthropic told Wiz the warning had shipped in version 2.1.32 on Feb. 5, more than a week before Wiz’s report arrived, as part of unrelated security hardening process, and that its earlier no-comment response had come from an automated triage system. Anthropic did not confirm or deny any connection between the fix and Wiz’s findings.

Amazon, Cursor and Google treated the issue as a genuine vulnerability and shipped fixes. AWS patched the background software that powers Amazon Q’s editing features in version 1.69.0 and tracked it as CVE-2026-12958. Cursor fixed the issue in version 3.0. It’s advisory for CVE-2026-50549 credits Wiz and Cato AI Labs, whose separate research on Cursor’s sandbox identified an overlapping symlink flaw. Google patched Antigravity in version 1.19.6 in May. Augment and Windsurf acknowledged receiving Wiz’s report but had not shipped fixes, said Wiz. Windsurf’s tool wrote the attacker’s SSH key to disk before its approval buttons even appeared onscreen, according to Wiz’s testing.

Wiz is not the only research group to flag the pattern. Adversa AI published related findings in May under the name SymJack, testing the same symlink-following weakness against six tools, including Claude Code, Cursor and Antigravity, the same three Wiz later tested, along with GitHub Copilot, OpenAI’s Codex and xAI’s Grok Build. Adversa described the underlying failure the same way Wiz did, saying that a developer approves what the prompt shows, while the write lands somewhere else.

Wiz frames GhostApproval as an unresolved design question for the AI coding industry rather than a single vendor’s bug. The firm says that a security control only works if the person using it can see what it actually controls and that a prompt naming the wrong file turns approval into a formality rather than a genuine decision. It recommends that tools resolve symlinks before displaying any approval prompt, flag writes that land outside a project’s workspace and avoid writing to disk before a developer has explicitly authorized the change.