GhostApproval leverages the symbolic link following behavior in file systems, where programs operate on the symlink target rather than the link itself. Attackers create symlinks in seemingly normal project repositories that redirect AI coding assistants to sensitive locations outside the workspace. When developers instruct AI assistants to make edits, the assistants follow these symlinks and write to the attacker's chosen targets. Confirmation dialogs intended to prevent unauthorized writes fail to display the canonical path, misleading users into approving harmful changes. This vulnerability affects multiple AI coding assistants including Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Augment, and Windsurf. AWS, Google, and Cursor have confirmed and patched the issue; Anthropic has mitigations in place and does not consider it a vulnerability; Augment and Windsurf have acknowledged the reports but not yet released fixes.

Successful exploitation of GhostApproval can lead to remote code execution on a developer's machine by tricking AI coding assistants into modifying sensitive system files. The attack bypasses sandboxing and confirmation dialogs by hiding the true file paths, rendering user approval ineffective. This compromises the security of developer environments and potentially the broader systems they have access to.

Patches have been released by AWS, Google, and Cursor to address this vulnerability. Anthropic has implemented mitigations and does not classify this as a vulnerability. Augment and Windsurf have acknowledged the issue but have not yet provided fixes. Users should apply available patches promptly. Until fixes are available, users should exercise caution when opening repositories from untrusted sources and verify file paths carefully. Monitor vendor advisories for updates on remediation status.