type: concept · created: 2026-07-11 · updated: 2026-07-11 · tags: [technique, supply-chain] · confidence: high · affected_sectors: [technology] · au_impact: false
GhostApproval
GhostApproval is a symlink-based attack technique disclosed by Wiz affecting six major AI coding assistants. A malicious repository uses unverified symlinks so a harmless-looking approval-file write lands on a sensitive system file instead of the intended location.
Affected Tools
| Product | Vendor | Status |
|---|---|---|
| Amazon Q Developer | Amazon | Fixed |
| Claude Code | Anthropic | Fixed |
| Augment | Augment | Fixed |
| Cursor | Cursor | Vulnerable at disclosure |
| Google Antigravity | Vulnerable at disclosure | |
| Windsurf | Windsurf | Vulnerable at disclosure |
Technical Detail
- Malicious repos use unverified symbolic links
- When an AI coding assistant writes to what appears to be a harmless approval file, the symlink redirects the write to a sensitive system file
- Three of the six affected vendors shipped fixes; three remained unpatched at disclosure (raw/digests/Cyber-Digest-2026-07-10)
Related Pages
- Hallusquatting — AI coding assistant supply chain attack (different vector)
- Mcp Tool Poisoning — MCP tool description attacks
- Uk Cyber Shield — Defensive AI context