Symlink Flaws in Six AI Coding Assistants Could Expose Files and Enable Code Execution
Summary
Wiz reports that symlink handling flaws in six AI coding assistants could expose files outside project workspaces or enable malicious writes. AWS, Cursor and Google fixed issues; remediation status varies for other vendors.
Key points
- A malicious repository can use a symlink to make an AI coding assistant read or write files outside its workspace.
- Reported impacts include exposing credentials, modifying sensitive files such as SSH authorized_keys, and potentially enabling persistent access or remote code execution.
- The researchers found issues in Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf, with differing behaviors and authorization controls.
- Some confirmation dialogs showed only the workspace path rather than the resolved target; in certain products, writes occurred before approval or without a prompt.
- AWS fixed its issue in language server version 1.69.0; Cursor fixed its issue in version 3.0; Google also deployed a fix.
- At publication, Augment and Windsurf had acknowledged reports without providing a fix update. Anthropic said its symlink warning had shipped before the report was submitted.
- The article recommends resolving symlinks before prompting, clearly warning when targets are outside the workspace, and requiring authorization before writing.
Article Details
- Vulnerability Types
- Symlink following that allows reads or writes outside the workspace
- UI misrepresentation of the resolved file target in confirmation prompts
- Severity
- High for Amazon Q Developer; Critical for Augment, Cursor, Google Antigravity, and Windsurf; disputed by Anthropic for Claude Code.
- Affected Versions
- Amazon Q Developer: language server versions earlier than 1.69.0
- Google Antigravity: 1.19.6
- Cursor: versions earlier than 3.0
- Augment: 0.754.3
- Windsurf: V1.9566 (tested)
- Anthropic Claude Code: v2.1.42 (tested)
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Resolve symlinks before displaying confirmation prompts.
- Warn explicitly when the resolved path is outside the workspace.
- Do not write to disk before explicit user authorization.
MITRE ATT&CK
CVE
CVE-2018-15664Symlinks have been exploited for decades – in race conditions (CVE-2018-15664), in package managers (CVE-2021-32803), in container escapes (CVE-2024-21626). Any time a tool writes to a user-controlled path withoutCVE-2021-32803Symlinks have been exploited for decades – in race conditions (CVE-2018-15664), in package managers (CVE-2021-32803), in container escapes (CVE-2024-21626). Any time a tool writes to a user-controlled path withoutCVE-2024-21626– in race conditions (CVE-2018-15664), in package managers (CVE-2021-32803), in container escapes (CVE-2024-21626). Any time a tool writes to a user-controlled path without resolving it first, symlinks become aCVE-2026-12958Amazon Web Services High CVE-2026-12958 Language server version < 1.69.0 Language server version 1.69.0 FixedCVE-2026-50549Cursor Critical CVE-2026-50549 < 3.0 3.0 Fixed
Vendors
Amazon Web ServicesWe reported these findings to all 6 vendors. Three fixed the issue promptly: AWS, Cursor and Google. Two acknowledged receipt but went silent. One provided a reasoned rejection, calling it "outside our threat model", aAnthropica systematic vulnerability pattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository canAugmentpattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent intoCognitionMarch 2, 2026 - Vulnerability report submitted to Cognition (Windsurf)Cursorpattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent intoGoogleaffecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent into accessing
Products
Amazon Q DeveloperGhostApproval, a systematic vulnerability pattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, aAugmentpattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent intoClaude Codevulnerability pattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick theCursorpattern affecting 6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent intoGoogle Antigravity6 of the top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent into accessing arbitraryWindsurfcoding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent into accessing arbitrary files outside the