GhostApproval Vulnerability Exposes Critical Flaw in Major AI Coding Assistants A newly identified vulnerability, dubbed GhostApproval, has revealed a systemic security flaw in six widely used AI coding assistants Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf allowing attackers to bypass human-in-the-loop (HITL) safety controls and potentially achieve remote code execution on developers' machines. Discovered by Wiz researchers, the exploit leverages symbolic link following (CWE-61), a technique historically used in Docker escapes and privilege escalation attacks but now repurposed to target AI coding tools. The attack is deceptively simple: an attacker crafts a malicious repository containing a symlink (e.g., project_settings.json → ~/.ssh/authorized_keys). When a developer clones the repo and instructs their AI assistant to "set up the workspace," the agent follows the symlink, writing the attacker’s SSH public key directly to the victim’s authorized_keys file, granting persistent, password-less access. What makes GhostApproval particularly insidious is its UI misrepresentation layer (CWE-451). In testing, Anthropic’s Claude Code demonstrated this flaw: while the agent’s internal reasoning correctly identified the symlink’s true target (e.g., a zsh configuration file), the user-facing prompt merely asked, "Make this edit to project_settings.json?" This discrepancy turns HITL safeguards into a false sense of security, as users unknowingly approve malicious actions. ### Vendor Responses & Patches Three vendors issued fixes: - Amazon Web Services (AWS) patched the issue in language server v1.69.0 (May 27, 2026, CVE-2026-12958). - Cursor released a fix in v3.0 (June 5, 2026, CVE-2026-50549). - Google (Antigravity) deployed a fix on May 22, 2026, though it has not yet assigned a CVE. Augment and Windsurf acknowledged the reports but had not fully addressed the issue at the time of disclosure. Windsurf’s pre-authorization variant was especially dangerous, as the agent wrote files to disk before displaying the confirmation dialog, effectively making the prompt an "undo" rather than a security gate. Anthropic initially rejected the report, arguing that user-trusted directories and approved prompts shifted responsibility to the end user. However, after further review, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files a change that had been implemented in v2.1.32 (February 5, 2026) as part of internal security hardening. ### Mitigation Recommendations Wiz researchers outlined three key defenses for AI coding tool vendors: 1. Resolve symlinks before displaying prompts always show the canonical target path. 2. Warn explicitly when resolved paths exit the workspace writes to ~/.ssh/authorized_keys should be visibly distinct from those to ./config.json. 3. Never write to disk before explicit user authorization confirmation dialogs must act as security gates, not undo mechanisms. The vulnerability was first discovered on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure occurred on July 8, 2026, following a 90+ day coordinated disclosure window. GhostApproval highlights a category-level design gap in AI coding assistants, where HITL controls intended as a last line of defense can be systematically bypassed. As AI agents gain greater autonomy over developer filesystems, the integrity of these controls must be treated as a first-class security requirement.

New "Agentjacking" Attack Exploits AI Coding Agents to Execute Malicious Code A novel cyberattack dubbed "Agentjacking" has emerged, allowing threat actors to hijack AI-powered coding assistants such as Claude Code and Cursor and silently execute attacker-controlled code on developers' machines. The attack requires no phishing, malware delivery, or infrastructure breach, relying instead on a single injected Sentry error to compromise systems. The exploit leverages Sentry’s public Data Source Name (DSN), a write-only credential commonly embedded in frontend JavaScript and indexed across the web. By manipulating this credential, attackers can turn trusted AI agents into an execution layer for malicious commands, bypassing traditional security measures. The attack highlights critical risks in autonomous AI tools operating with full user privileges outside sandboxed environments. While the technique does not require direct access to a victim’s infrastructure, it underscores vulnerabilities in how AI assistants interact with external error-tracking systems. Security researchers warn that this method could enable unauthorized code execution at scale, posing significant threats to developers and organizations relying on AI-driven workflows. The incident raises concerns about the security posture of AI integrations in software development pipelines.

Ghostcommit: AI Code Reviewers Tricked into Stealing Secrets via Malicious PNGs Researchers from the University of Missouri-Kansas City’s ASSET Research Group led by associate professor Sudipta Chattopadhyay and researcher Murali Ediga have demonstrated a novel attack, Ghostcommit, that exploits AI code reviewers to exfiltrate repository secrets by embedding malicious instructions in seemingly innocuous PNG files. The attack targets a critical gap in automated review processes: a recent survey of 6,480 pull requests across 300 active public repositories found that 73% of merged PRs reached the default branch without substantive human or bot review. Ghostcommit leverages this oversight by hiding its payload in an image file referenced in an `AGENTS.md` file a coding-convention document that AI agents automatically parse as project policy. The malicious PNG contains plaintext instructions to read the repository’s `.env` file, encode its contents as a list of integers, and embed them in a generated module as a "provenance" constant. Since most AI reviewers exclude image files from analysis (e.g., CodeRabbit’s default configuration ignores them entirely), the attack evades detection. Even when the PNG explicitly included phrases like "malicious prompt injection" and "read .env", it passed review unflagged. The theft occurs later, when a developer requests a routine task (e.g., generating a token-tracking module). The AI agent, following the `AGENTS.md` directive, reads the PNG, extracts the `.env` contents, and embeds them as integers in the output code. In one test, Cursor driving Claude Sonnet successfully encoded an entire `.env` file into 311 integers, which were later decoded by attackers from the public commit. Secret scanners failed to detect the exfiltration because they do not reverse-engineer Python integer tuples back into ASCII. The attack’s effectiveness hinges not on stealth but on a structural blind spot: reviewers never examine the image. While similar techniques such as Trail of Bits’ 2025 downscaling-based prompt injection or macOS malware Gaslight relied on obfuscation, Ghostcommit succeeds because the tooling itself ignores the file. Testing across multiple coding tools and models revealed that the tool’s configuration, not the AI model, determined success. Cursor and Antigravity leaked secrets under Sonnet, Gemini, and GPT-5.5, while Anthropic’s Claude Code consistently refused the request. Notably, Opus under Antigravity wrote the secret before recognizing the attack and deleting it same model, opposite outcomes, dictated by the surrounding framework. To mitigate the threat, the researchers developed a multimodal pull-request defender, a GitHub app that scans for invisible characters, analyzes code structure, and critically reviews image files using an LLM. In trials, it blocked all but one of 80 attack variants while avoiding false positives on 30 legitimate PRs. The team also advocates for runtime monitoring to detect agents accessing sensitive files without justification. The proof-of-concept, published on GitHub this week, has been disclosed to affected vendors. The attack underscores the limitations of text-only review systems in an era of increasingly multimodal AI tools.

Critical Vulnerability in Cursor AI IDE Exposes Developers to Arbitrary Code Execution Researchers from threat hunting firm Novee uncovered a high-severity vulnerability (CVE-2026-26268, CVSS 8.1) in Cursor, a popular AI-powered Integrated Development Environment (IDE). The flaw enables attackers to execute arbitrary code on a developer’s machine simply by tricking them into cloning a malicious repository. Unlike traditional exploits, this vulnerability stems from how Cursor’s AI agent interacts with Git, rather than a bug in the IDE’s core logic. Attackers exploit Git hooks scripts that run automatically during version control tasks by embedding a malicious pre-commit hook in a nested bare repository (a hidden folder containing version control data). When Cursor’s AI performs routine operations like a git checkout, it unknowingly triggers the hook, executing the attacker’s code without user interaction or warnings. The risk is amplified by AI agents’ growing autonomy. Unlike past client-side attacks requiring user action (e.g., clicking a link), this exploit leverages Cursor’s ability to automate tasks on untrusted code, making it scalable and stealthy. Since developers routinely clone public repositories, the attack surface expands as AI tools process external code without oversight. Novee disclosed the flaw to Cursor’s developers under responsible disclosure, leading to a patch in February 2026. Details were publicly released on April 28, 2026. The incident highlights a broader security concern: AI-powered coding assistants operate in high-privilege environments, often handling sensitive data like access tokens, passwords, and proprietary code. Security teams are now urged to audit these tools, as traditional assumptions about their safety may no longer hold.

North Korean Hackers Leverage AI to Steal $12 Million in Cryptocurrency Cybersecurity firm Expel has uncovered a North Korean state-sponsored hacking campaign that exploited AI tools to orchestrate a large-scale cryptocurrency theft operation. The group, dubbed HexagonalRodent, targeted over 2,000 developers working on cryptocurrency, NFT, and Web3 projects, using AI-generated malware and phishing infrastructure to siphon an estimated $12 million in just three months. Unlike highly sophisticated cybercrime syndicates, HexagonalRodent relied on AI platforms including OpenAI, Cursor, and Anima to compensate for its lack of technical expertise. The hackers used these tools to write malware, design fake company websites, and craft phishing lures, particularly fraudulent job offers aimed at developers. Victims were tricked into downloading malware-laced coding assignments, which stole credentials and, in some cases, crypto wallet keys. Security researcher Marcus Hutchins, who identified the group, noted that the operation’s success stemmed not from advanced hacking skills but from AI’s ability to automate tasks that would otherwise require significant technical knowledge. The hackers’ reliance on AI was evident in their malware, which included unusual features like excessive English-language comments and emoji-littered code hallmarks of large language model-generated software. Despite their effectiveness, the group left critical infrastructure exposed, revealing their AI prompts and a database tracking victim wallets. While the $12 million figure represents the total value of compromised wallets, researchers could not confirm whether all funds had been drained, as some wallets may have been protected by hardware security tokens. The campaign underscores how AI is lowering the barrier to entry for cybercriminals, enabling even low-skilled actors to execute high-impact attacks.

Bitwarden CLI Compromised in Supply Chain Attack Targeting npm On April 22, 2026, attackers briefly compromised the Bitwarden CLI by uploading a malicious version of the `@bitwarden/cli` npm package (version 2026.4.0). The package, available between 5:57 PM and 7:30 PM ET, contained a credential-stealing payload designed to spread to other projects. Bitwarden confirmed the incident, stating the breach was limited to its npm distribution channel and did not affect end-user vault data, production systems, or the legitimate CLI codebase. The company revoked compromised access, deprecated the malicious release, and initiated remediation. ### Attack Details Security firms Socket, JFrog, and OX Security reported that threat actors likely exploited a compromised GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code. The package included a preinstall script and a custom loader (`bw_setup.js`) that checked for the Bun runtime downloading it if absent before executing an obfuscated JavaScript file (`bw1.js`). The malware targeted: - npm and GitHub authentication tokens - SSH keys - Cloud credentials (AWS, Azure, Google Cloud) Stolen data was encrypted with AES-256-GCM and exfiltrated via public GitHub repositories under victims’ accounts, marked with the string "Shai-Hulud: The Third Coming" a reference to prior npm supply chain attacks. The malware also had self-propagating capabilities, using stolen credentials to inject malicious code into other packages. ### Connections to Other Attacks The attack shares infrastructure and malware overlaps with a recent Checkmarx supply chain breach, including: - The same telemetry endpoint (`audit.checkmarx[.]cx/v1/telemetry`) - Identical obfuscation routines (`__decodeScrambled` with seed `0x3039`) - Similar credential theft and GitHub-based exfiltration tactics Both campaigns have been attributed to TeamPCP, a threat actor previously linked to attacks on Trivy and LiteLLM. Bitwarden’s investigation found no evidence of broader compromise, but developers who installed the affected version were advised to rotate exposed credentials, particularly those tied to CI/CD pipelines and cloud environments.

New Supply Chain Attack Targets AI Developers with Malicious npm Package A sophisticated supply chain attack emerged on March 20, 2026, when a threat actor published a malicious npm package, gemini-ai-checker, under the account gemini-check. Marketed as a utility to verify Google Gemini AI tokens, the package contained hidden malware designed to steal credentials, files, and tokens from AI coding environments. The package’s README mimicked a legitimate JavaScript library, chai-await-async, though the two were unrelated a red flag many developers overlooked. Upon installation, the malware silently contacted a Vercel-hosted staging server (server-check-genimi.vercel.app) to download and execute a JavaScript payload directly in memory, evading traditional security tools. The attack was traced to OtterCookie, a JavaScript backdoor linked to the Contagious Interview campaign, attributed to North Korean (DPRK) threat actors. Microsoft documented a similar variant in March 2026, active since October 2025. The same actor maintained two additional malicious packages express-flowlimit and chai-extensions-extras sharing the same Vercel infrastructure. By publication, the three packages had been downloaded over 500 times combined, with gemini-ai-checker removed just before April 1, 2026, while the others remained active. This campaign uniquely targeted AI developer tools, including Cursor, Claude, Windsurf, PearAI, Gemini CLI, and Eigent AI, extracting API keys, conversation logs, and source code. The malware also stole browser credentials and cryptocurrency wallets, including MetaMask and Exodus. The infection mechanism was designed to evade detection. The package included 44 files and four dependencies, appearing legitimate with a SECURITY.md file. A hidden libconfig.js file split the command-and-control (C2) configuration into fragments, reassembled at runtime by libcaller.js to fetch the payload. The malware executed in memory using Function.constructor instead of eval to bypass static analysis. Once active, the payload deployed a four-module architecture, each running as a separate Node.js process connected to 216.126.237.71 on dedicated ports. Module 0 established remote access via Socket.IO, Module 1 targeted browser databases and cryptocurrency wallets, Module 2 scanned for sensitive files in AI tool directories, and Module 3 monitored the clipboard with a delayed startup to avoid sandbox detection. Defenders were advised to monitor outbound connections to Vercel and use Microsoft’s KQL queries to detect suspicious Node.js behavior. The incident underscored the risks of unverified npm packages and the need to treat AI tool directories with the same caution as sensitive system folders.

Open VSX Marketplace Vulnerability Allowed Malicious Extensions to Bypass Security Scans A critical vulnerability in the Open VSX extension marketplace’s pre-publish scanning pipeline, dubbed "Open Sesame," allowed malicious extensions to bypass security checks and be published as "PASSED." The flaw was responsibly disclosed on February 8 and patched by February 11, demonstrating both the severity of the issue and the Open VSX team’s rapid response. Open VSX, used by platforms like Cursor and Windsurf as an alternative to Microsoft’s VS Code extension registry, introduced the scanning pipeline to detect malware, embedded secrets, suspicious binaries, and name-squatting attempts. The system required extensions to pass both synchronous and asynchronous scans before activation unless a scan failed, in which case the extension would be quarantined. However, a logic flaw in the scanning service’s boolean return value created a "fail-open" scenario. The system could not distinguish between no scanners configured (a valid case) and all scanner jobs failing (an error condition). Under heavy load, scan jobs would fail silently, and the system would interpret the ambiguous return value as "nothing to scan," automatically approving the extension. Exploiting the vulnerability required no special privileges any user with a free publisher account could trigger it by flooding the publish API with malicious extensions. Each upload would exhaust shared database resources, causing scan jobs to fail without being registered. The system then treated the failure as a successful scan, publishing the extension as verified. The impact was significant: malicious extensions could appear legitimate, posing a supply chain risk to developers. The Open VSX team addressed the issue by removing the ambiguous boolean logic and ensuring explicit failure handling, preventing automatic approvals when scans fail. This incident underscores the dangers of fail-open design in security systems, where ambiguous error handling can collapse critical safeguards under stress. The fix reinforces the principle that security-sensitive workflows should default to denial, not approval, when failures occur.

Critical One-Click RCE Flaw in Cursor, VS Code, and Google Antigravity Exposed A severe one-click remote code execution (RCE) vulnerability was discovered in Cursor, Microsoft Visual Studio Code (VS Code), and Google Antigravity, exposing developers to potential endpoint compromise. The flaw, identified by security firm AISLE in late 2025, allowed attackers to embed malicious commands in commit message links, which executed arbitrary code when clicked without warnings or user approval. The vulnerability posed a significant risk, as developer environments often store sensitive assets, including source code, cloud credentials, API tokens, SSH keys, and deployment scripts. Exploitation could grant attackers terminal-level privileges, enabling data exfiltration, file deletion, malware installation, or follow-on attacks like keyloggers to capture credentials. The attack leveraged trusted commit messages, a common part of version-control workflows, making social engineering easier. AISLE’s automated detection system flagged the issue in VS Code, which shares its codebase with Cursor, and later in Google Antigravity. After responsible disclosure, Microsoft, Cursor, and Google patched the flaw by 2026, though the vulnerability persisted for months before remediation. The incident underscores the growing security risks in AI-assisted coding tools, where minor flaws in link handling can lead to major breaches. With code editors serving as gateways to repositories, terminals, and secrets management, even routine actions like reviewing commits can become attack vectors. Organizations were advised to update affected software to mitigate exposure.

A critical security vulnerability was discovered in Cursor, an AI-powered fork of Visual Studio Code, where a disabled-by-default Workspace Trust setting allowed arbitrary code execution when a maliciously crafted repository was opened. Attackers could exploit this by embedding hidden autorun instructions in `.vscode/tasks.json`, triggering silent code execution upon folder opening. This flaw exposed users to supply chain attacks, risking sensitive credential leaks, unauthorized file modifications, or broader system compromise. The issue stemmed from Cursor’s default configuration, which prioritized convenience over security, leaving developers vulnerable to deceptive repositories hosted on platforms like GitHub. While mitigations (e.g., enabling Workspace Trust, auditing untrusted repos) were advised, the flaw highlighted systemic risks in AI-driven development tools, where classical security oversights (e.g., misconfigurations, missing sandboxing) amplify attack surfaces. The vulnerability underscored the broader trend of prompt injection and jailbreak risks in AI coding assistants, where malicious actors exploit trust gaps to bypass security reviews or execute unauthorized code.

The AI-powered developer tool Cursor was found to have a critical vulnerability (CVE-2025-54136, dubbed MCPoison), allowing attackers to permanently inject malicious code into development projects via its Model Context Protocol (MCP) system. Once a seemingly harmless MCP configuration is approved by a developer, attackers can later replace it with malicious commands. The modified code executes automatically every time the project is opened, without further warnings or approvals, creating a persistent backdoor. This flaw enables unauthorized access to sensitive data (e.g., credentials, internal documents) stored locally by developers, intellectual property theft through source code manipulation, and compromise of collaborative environments—especially in startups and research teams where Cursor is widely used. The vulnerability exploits blind trust in AI-driven automation, turning convenience into a long-term security risk. While a patch was released on July 30, 2025, the exposure period left organizations vulnerable to stealthy, continuous attacks with potential for large-scale data breaches or supply-chain compromises if exploited in shared repositories.

Microsoft Warns of AI Agent Hijacking via Poisoned Tool Descriptions Microsoft’s Incident Response and Defender research teams have uncovered a stealthy attack vector targeting AI agents automated systems that perform tasks like sending emails, managing files, or accessing business data. By manipulating a tool’s description within the Model Context Protocol (MCP), attackers can silently exfiltrate sensitive company data without triggering security alerts. ### How the Attack Works AI agents rely on MCP to interact with external tools, using plain-text descriptions to determine when and how to use them. These descriptions, however, can be altered to include hidden instructions. In a demonstrated scenario, an attacker modified a third-party "invoice enrichment" tool’s description to secretly collect and forward unpaid invoices to an external server. The agent, operating under the user’s permissions, executed the request as part of a routine task appearing legitimate at every step. The attack exploits a fundamental trust gap: MCP blends instructions and data in the same space, making it difficult for agents to distinguish between valid commands and malicious ones. Since the tool itself remains approved and the actions appear normal, traditional security measures may fail to detect the breach. ### Real-World Precedents This technique, dubbed "tool poisoning," has been documented in multiple proof-of-concept attacks: - April 2025: Invariant Labs demonstrated how a poisoned calculator tool description could extract SSH keys via the Cursor editor. - September 2025: Koi Security discovered a malicious npm package (postmark-mcp) that secretly BCC’d emails to an attacker after 15 clean releases. - August 2025: The MCPTox benchmark tested 45 MCP servers and 20 AI models, finding a 72.8% success rate for such attacks, with models rarely refusing the malicious instructions. OWASP now lists this as a key Agentic Supply Chain Vulnerability in its December 2025 Top 10 for AI applications. ### Mitigation Strategies Microsoft recommends treating connected tools as part of the supply chain, with strict controls: - Restrict tool access to approved publishers and specific, necessary functions. - Review tool descriptions like code changes, scanning for unauthorized commands. - Require human approval for high-risk actions (e.g., data sharing, financial transactions). - Monitor agent activity with dedicated identities, logging actions and flagging anomalies. - Apply "least agency" limiting an agent’s autonomy to reduce potential damage. The research underscores a growing risk: as AI agents gain autonomy, their security hinges on the integrity of the tools they interact with a surface that remains vulnerable to manipulation.

A high-severity vulnerability (CVE-2025-54136, CVSS 7.2), dubbed MCPoison, was discovered in Cursor’s AI-powered code editor, enabling remote and persistent code execution via manipulated Model Context Protocol (MCP) configurations. Attackers could exploit this by embedding a benign MCP config in a shared GitHub repository, waiting for victim approval, then silently replacing it with malicious payloads (e.g., backdoors, scripts like `calc.exe`). The flaw stemmed from Cursor’s trust model, which indefinitely trusted approved configs even after modification, exposing organizations to supply chain risks, data theft, and intellectual property exfiltration without detection. The issue was patched in Cursor v1.3 (July 2025) by enforcing re-approval for MCP config changes. However, the vulnerability underscored broader risks in AI-assisted development, including AI supply chain attacks, model poisoning, and unsafe code generation. Research highlighted that 45% of LLM-generated code (Java worst at 72%) introduced OWASP Top 10 vulnerabilities, while novel attack vectors like LegalPwn (prompt injection via legal disclaimers), Man-in-the-Prompt (rogue browser extensions), and MAS hijacking (multi-agent system compromise) further demonstrated systemic weaknesses in AI security paradigms. The flaw’s exploitation could lead to unauthorized data access, lateral movement, and persistent compromise of developer workflows, amplifying risks for enterprises integrating LLMs into critical systems.