cyber.hendryadrian.com
Security Insights · toxsec.com

GhostApproval: Symlinks Can Mislead AI Coding Assistant Approval Prompts

· Original article ↗

Summary

GhostApproval can make AI coding assistants display a benign filename while writing through a symlink to a sensitive file. The article describes vendor examples and recommends safeguards such as symlink scanning and filesystem sandboxing.

Key points

  • An attacker can place a symlink in a repository and use README instructions to prompt an AI coding assistant to write to its sensitive target, such as ~/.ssh/authorized_keys.
  • The article says approval prompts in several assistants showed an innocent or misleading path even when the write went to the symlink’s resolved destination.
  • Reported behaviors varied: Cursor wrote to the resolved target after approval, Antigravity showed a sibling or symlink path and has since been fixed, and Windsurf displayed its prompt after writing.
  • The article describes a case where an assistant silently read an AWS credentials file through a symlink and wrote SSH keys and shell payloads without prompting.
  • The author reports that most vendors had fixed the issue or planned fixes, while noting that behavior may vary by tool and interface.
  • Recommended safeguards include treating cloned repositories as untrusted, scanning for symlinks, checking resolved destinations in prompts and diffs, monitoring sensitive files, and sandboxing agents at the filesystem level.

Article Details

Topic
GhostApproval symlink attacks that misrepresent file destinations or display approval prompts after writes in AI coding assistants

Vendors

AnthropicNow I think it’s interesting here because Anthropic initially rejected this report as outside of their threat model, reasoning that a user trusted the directory at the start of the session, and since the user alsoCursoris a vulnerability pattern hitting AI coding assistants. It was demonstrated against Claude Code, Cursor, and Google’s Antigravity. The idea is that the agent resolves a symlink to its true sensitiveGooglevulnerability pattern hitting AI coding assistants. It was demonstrated against Claude Code, Cursor, and Google’s Antigravity. The idea is that the agent resolves a symlink to its true sensitive destination, sometimesWindsurfWindsurf prompt after the write keys already on disk

Products

Antigravitypattern hitting AI coding assistants. It was demonstrated against Claude Code, Cursor, and Google’s Antigravity. The idea is that the agent resolves a symlink to its true sensitive destination, sometimes literallyClaude CodeGhostApproval is a vulnerability pattern hitting AI coding assistants. It was demonstrated against Claude Code, Cursor, and Google’s Antigravity. The idea is that the agent resolves a symlink to its true sensitiveCursoris a vulnerability pattern hitting AI coding assistants. It was demonstrated against Claude Code, Cursor, and Google’s Antigravity. The idea is that the agent resolves a symlink to its true sensitiveWindsurfWindsurf prompt after the write keys already on disk

Related Articles