Vulnerability / research

GhostApproval hides coding agents' true file-write destinations

Reported

What happened

Researchers demonstrated symlink and approval-boundary weaknesses that could conceal sensitive file-write destinations across six coding assistants, sometimes enabling out-of-workspace writes and code execution.

Parties and reporting

AI tools and systems: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf

Outcome

Several vendors shipped fixes or stronger warnings; responses differed, and Anthropic disputed part of the threat-model interpretation.

Operating lesson

Resolve and display final file destinations before approval, and enforce write boundaries independently of the agent.

Evidence and limits

July 8 is the grouped research disclosure; some component CVEs were public in June. Controlled demonstrations, with no malicious exploitation established.

Sources