In a disclosure published this week, six of the most prominent AI coding assistants — Amazon Q Developer, Anthropic’s Claude Code, Cursor, Google Antigravity, Augment, and Windsurf — share a security flaw that lets a booby-trapped code repository trick the tools into writing files outside the project folder they were supposed to stay inside. Cloud security firm Wiz disclosed the flaw, which it named GhostApproval, on July 8, 2026, after testing all six against a filesystem feature that predates AI coding tools by decades: the symbolic link. What’s even more disturbing is that all six tools are among the most widely deployed AI coding assistants on the market, a footprint that significantly expands how many enterprises are exposed.
The mechanism is simple enough that Wiz called it a design question the industry has yet to settle, not a one-off bug. An attacker builds a repository containing a seemingly routine file — something like project_settings.json — but is actually a symlink pointing to a sensitive location on disk, such as the folder holding a developer’s SSH keys. When the developer asks their AI assistant to set up the working environment, the agent follows the link and writes attacker-supplied content there, for instance a public key that grants persistent, passwordless access to the victim’s machine. The assistant’s approval prompt shows the harmless-looking filename, not the real destination of the write.
The severity of the flaw varied sharply by vendor. Wiz described the range as running from a fixable interface issue to pre-authorization remote code execution. Amazon Q was on the serious end: testing showed the agent’s internal reasoning correctly identified the symlink, then wrote to the filesystem anyway, before the user ever saw an undo option. AWS treated the report collaboratively and shipped a fix in language server version 1.69.0 on May 27, assigned CVE-2026-12958. Google patched on May 22. Cursor followed on June 5 with version 3.0, tracked as CVE-2026-50549.
Two vendors have not yet closed the gap. Augment and Windsurf acknowledged Wiz’s report but have yet to ship fixes as of publication, with patches reportedly still in progress in versions 0.754.3 and 1.9566 respectively. Anthropic, on the other hand, took a different position entirely, disputing that Claude Code’s behavior counts as a vulnerability at all. The company’s argument: a user who trusts a directory and approves an edit owns that decision, which places the scenario outside its threat model. That stance splits the six affected vendors into three camps — patched, acknowledged-but-exposed, and disputed — leaving enterprise security teams with no single standard to audit against.
Wiz’s guidance to vendors was narrow and specific: resolve symlinks before presenting an approval prompt, and flag any write that lands outside the declared project directory, regardless of what the filename suggests. That fix is not architecturally difficult — it is a validation step most traditional file-management software has included for years. The fact that six separate, well-funded AI coding tools shipped without it suggests the industry’s approval workflows were designed around trusting the model’s stated intent rather than verifying the actual destination of a write, a gap that speed-to-market pressure in the agentic coding race likely widened rather than narrowed.
An evergreen pattern, not an isolated incident
GhostApproval lands on top of a year of escalating findings about how AI-generated and AI-assisted code behaves under real-world conditions. In 2025, a prompt-injection flaw in GitHub Copilot let hidden instructions inside a pull request description trigger remote code execution, rated 9.6 on the CVSS severity scale. Microsoft 365 Copilot had its own high-profile data-exposure flaw, dubbed EchoLeak, the same year.
The volume data also reveals a broader trend. Research from application security firm Apiiro, published in September 2025, found AI-generated code was introducing more than 10,000 new security findings per month across the repositories it studied — a tenfold increase in six months, with privilege-escalation paths up 322% and architectural design flaws up 153%. A separate comparison from CodeRabbit found AI-authored pull requests carried 1.75 times more logic and correctness errors than human-authored ones, 1.57 times more security findings, and were 2.74 times more likely to introduce cross-site scripting vulnerabilities. GhostApproval fits a pattern where the underlying flaw is old and well understood — symlink abuse, prompt injection — but the blast radius is new, because agents now execute changes at a speed and volume no human reviewer can match.
What comes next
Expect enterprise AI-tool procurement checklists to add explicit symlink and path-traversal questions by early 2027, following the same trajectory server-side request forgery questions took after earlier disclosure waves became standard vetting criteria. Wiz, backed by Google’s resources, is also likely to keep publishing coordinated, cross-vendor disclosures like this one rather than single-product reports — the format is what drove this week’s coverage in the first place, and it puts pressure on laggard vendors in a way isolated reports do not.
The more consequential fight is the one Wiz flagged explicitly: whether an AI coding tool should shield a developer from a deceptive workspace, or whether that responsibility belongs entirely to the human clicking approve. Anthropic’s position that this falls outside its threat model will likely be tested again, either by a future disclosure or by an actual incident that forces the question in public.
What it means for businesses
The vendor split matters more than the raw vulnerability count. Enterprises cannot assume a uniform security baseline across agentic coding tools just because six competitors were tested with one methodology and got one name attached to the flaw. Security teams need to test each vendor’s approval flow independently, particularly whether the tool resolves symlinks and flags writes that land outside the declared project directory before asking for sign-off.
Organizations running Augment or Windsurf carry live exposure until patches ship. In the interim, the practical mitigation is restricting what agents can write to, and treating repositories from external contributors, open-source dependencies, or any source outside direct organizational control with the same caution applied to unreviewed pull requests from unknown accounts.
Anthropic customers face a different calculus. Because the company has classified this behavior as expected rather than a bug, enterprises using Claude Code should not wait for a vendor-side fix — the same protection has to come from internal policy: sandboxing repositories of uncertain provenance, and not granting coding agents write access to credential stores or system directories by default.
Procurement teams evaluating new agentic coding tools should also treat vendor response style as a signal in its own right. AWS, Google, and Cursor moved quickly and coordinated disclosure timing with Wiz, which suggests functioning internal processes for triaging third-party security research. A vendor that goes quiet after acknowledgment, or that argues a reported flaw falls outside its threat model, is telling enterprise buyers something about how it will likely handle the next disclosure too — information worth weighing alongside the tool’s feature set during renewal conversations.
The broader lesson extends past this one disclosure. Security review processes built around human-paced code review do not map cleanly onto agentic tools acting at machine speed across thousands of decisions a day. A single missed trust boundary, previously a slow-burn risk caught in code review, can now be repeated silently across an entire codebase before anyone notices the pattern. Governance frameworks written for conventional software development were not built for that difference in speed, and GhostApproval is unlikely to be the last disclosure that makes the gap visible.
