Decades-old symlink trick lets AI code assistants alter files

Wiz researchers demonstrated GhostApproval, an attack that uses a decades-old symbolic link trick to make AI coding assistants follow repository links and modify files outside a developer’s workspace. Wiz reported the findings to affected vendors in the first quarter of 2026 and published technical details on Wednesday.

GhostApproval works by placing a symbolic link inside a seemingly normal project file that points to a sensitive location outside the repository. When a developer opens the repository in an agent-enabled editor and asks the assistant to edit files, the agent may follow the symlink and write to the attacker-specified target.

Wiz tested the technique against Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Augment, and Windsurf. Amazon, Google and Cursor confirmed the issue and issued patches. Anthropic disputed that the findings constitute a vulnerability but previously applied mitigations against similar attacks. Augment and Windsurf acknowledged the report and had not released fixes at the time of Wiz’s disclosure.

Symlinks are a long-standing file system feature that let one path point to another. The problem GhostApproval exploits is how some AI tools resolve and display file paths when performing writes. Wiz found that several tools either follow symlinks without showing the canonical target in confirmation prompts or fail to indicate that an edit will operate outside the project workspace.

Wiz warned the attack could enable remote code execution by causing agents to modify system files, configuration files, or other locations that affect how code loads or runs. The attack requires an attacker to plant a malicious repository or persuade a developer to open one; repositories can be public or shared through collaboration tools.

Vendors that issued patches focused on preventing agents from following symlinks in unsafe contexts, resolving and displaying canonical paths in confirmation dialogs, and restricting write operations to the explicit workspace. Wiz noted that showing a confirmation dialog is not sufficient unless the dialog reports the true file target and any privilege boundaries crossed.

Wiz researchers wrote: “The symlink primitive alone is serious, but what we found goes deeper. Many of these tools have sandboxes or confirmation dialogs designed to prevent exactly this kind of attack. The failure is not just that the symlink is followed – it’s that the UI doesn’t reveal the true target.” They added: “The Human-in-the-Loop security model only works if the loop provides accurate information. When an agent shows one thing and does another, user approval becomes meaningless. The confirmation dialog transforms from a security control into a formality.”

Wiz urged developers to avoid opening untrusted repositories in agent-enabled environments and to apply vendor updates. The firm recommended stronger sandboxing, clearer path reporting in prompts, and policies that prevent agents from writing outside verified workspace boundaries without explicit, clearly presented consent.

Symlink attacks have been known since early Unix systems. Wiz’s report places the old technique in the context of modern AI development tools and outlines how basic file-system behavior can interact with automated agents.