GhostApproval Vulnerability Exposes Critical Flaw in Major AI Coding Assistants A newly identified vulnerability, dubbed GhostApproval, has revealed a systemic security flaw in six widely used AI coding assistants Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf allowing attackers to bypass human-in-the-loop (HITL) safety controls and potentially achieve remote code execution on developers' machines. Discovered by Wiz researchers, the exploit leverages symbolic link following (CWE-61), a technique historically used in Docker escapes and privilege escalation attacks but now repurposed to target AI coding tools. The attack is deceptively simple: an attacker crafts a malicious repository containing a symlink (e.g., project_settings.json → ~/.ssh/authorized_keys). When a developer clones the repo and instructs their AI assistant to "set up the workspace," the agent follows the symlink, writing the attacker’s SSH public key directly to the victim’s authorized_keys file, granting persistent, password-less access. What makes GhostApproval particularly insidious is its UI misrepresentation layer (CWE-451). In testing, Anthropic’s Claude Code demonstrated this flaw: while the agent’s internal reasoning correctly identified the symlink’s true target (e.g., a zsh configuration file), the user-facing prompt merely asked, "Make this edit to project_settings.json?" This discrepancy turns HITL safeguards into a false sense of security, as users unknowingly approve malicious actions. ### Vendor Responses & Patches Three vendors issued fixes: - Amazon Web Services (AWS) patched the issue in language server v1.69.0 (May 27, 2026, CVE-2026-12958). - Cursor released a fix in v3.0 (June 5, 2026, CVE-2026-50549). - Google (Antigravity) deployed a fix on May 22, 2026, though it has not yet assigned a CVE. Augment and Windsurf acknowledged the reports but had not fully addressed the issue at the time of disclosure. Windsurf’s pre-authorization variant was especially dangerous, as the agent wrote files to disk before displaying the confirmation dialog, effectively making the prompt an "undo" rather than a security gate. Anthropic initially rejected the report, arguing that user-trusted directories and approved prompts shifted responsibility to the end user. However, after further review, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files a change that had been implemented in v2.1.32 (February 5, 2026) as part of internal security hardening. ### Mitigation Recommendations Wiz researchers outlined three key defenses for AI coding tool vendors: 1. Resolve symlinks before displaying prompts always show the canonical target path. 2. Warn explicitly when resolved paths exit the workspace writes to ~/.ssh/authorized_keys should be visibly distinct from those to ./config.json. 3. Never write to disk before explicit user authorization confirmation dialogs must act as security gates, not undo mechanisms. The vulnerability was first discovered on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure occurred on July 8, 2026, following a 90+ day coordinated disclosure window. GhostApproval highlights a category-level design gap in AI coding assistants, where HITL controls intended as a last line of defense can be systematically bypassed. As AI agents gain greater autonomy over developer filesystems, the integrity of these controls must be treated as a first-class security requirement.

Ghostcommit: AI Code Reviewers Tricked into Stealing Secrets via Malicious PNGs Researchers from the University of Missouri-Kansas City’s ASSET Research Group led by associate professor Sudipta Chattopadhyay and researcher Murali Ediga have demonstrated a novel attack, Ghostcommit, that exploits AI code reviewers to exfiltrate repository secrets by embedding malicious instructions in seemingly innocuous PNG files. The attack targets a critical gap in automated review processes: a recent survey of 6,480 pull requests across 300 active public repositories found that 73% of merged PRs reached the default branch without substantive human or bot review. Ghostcommit leverages this oversight by hiding its payload in an image file referenced in an `AGENTS.md` file a coding-convention document that AI agents automatically parse as project policy. The malicious PNG contains plaintext instructions to read the repository’s `.env` file, encode its contents as a list of integers, and embed them in a generated module as a "provenance" constant. Since most AI reviewers exclude image files from analysis (e.g., CodeRabbit’s default configuration ignores them entirely), the attack evades detection. Even when the PNG explicitly included phrases like "malicious prompt injection" and "read .env", it passed review unflagged. The theft occurs later, when a developer requests a routine task (e.g., generating a token-tracking module). The AI agent, following the `AGENTS.md` directive, reads the PNG, extracts the `.env` contents, and embeds them as integers in the output code. In one test, Cursor driving Claude Sonnet successfully encoded an entire `.env` file into 311 integers, which were later decoded by attackers from the public commit. Secret scanners failed to detect the exfiltration because they do not reverse-engineer Python integer tuples back into ASCII. The attack’s effectiveness hinges not on stealth but on a structural blind spot: reviewers never examine the image. While similar techniques such as Trail of Bits’ 2025 downscaling-based prompt injection or macOS malware Gaslight relied on obfuscation, Ghostcommit succeeds because the tooling itself ignores the file. Testing across multiple coding tools and models revealed that the tool’s configuration, not the AI model, determined success. Cursor and Antigravity leaked secrets under Sonnet, Gemini, and GPT-5.5, while Anthropic’s Claude Code consistently refused the request. Notably, Opus under Antigravity wrote the secret before recognizing the attack and deleting it same model, opposite outcomes, dictated by the surrounding framework. To mitigate the threat, the researchers developed a multimodal pull-request defender, a GitHub app that scans for invisible characters, analyzes code structure, and critically reviews image files using an LLM. In trials, it blocked all but one of 80 attack variants while avoiding false positives on 30 legitimate PRs. The team also advocates for runtime monitoring to detect agents accessing sensitive files without justification. The proof-of-concept, published on GitHub this week, has been disclosed to affected vendors. The attack underscores the limitations of text-only review systems in an era of increasingly multimodal AI tools.

Critical One-Click RCE Flaw in Cursor, VS Code, and Google Antigravity Exposed A severe one-click remote code execution (RCE) vulnerability was discovered in Cursor, Microsoft Visual Studio Code (VS Code), and Google Antigravity, exposing developers to potential endpoint compromise. The flaw, identified by security firm AISLE in late 2025, allowed attackers to embed malicious commands in commit message links, which executed arbitrary code when clicked without warnings or user approval. The vulnerability posed a significant risk, as developer environments often store sensitive assets, including source code, cloud credentials, API tokens, SSH keys, and deployment scripts. Exploitation could grant attackers terminal-level privileges, enabling data exfiltration, file deletion, malware installation, or follow-on attacks like keyloggers to capture credentials. The attack leveraged trusted commit messages, a common part of version-control workflows, making social engineering easier. AISLE’s automated detection system flagged the issue in VS Code, which shares its codebase with Cursor, and later in Google Antigravity. After responsible disclosure, Microsoft, Cursor, and Google patched the flaw by 2026, though the vulnerability persisted for months before remediation. The incident underscores the growing security risks in AI-assisted coding tools, where minor flaws in link handling can lead to major breaches. With code editors serving as gateways to repositories, terminals, and secrets management, even routine actions like reviewing commits can become attack vectors. Organizations were advised to update affected software to mitigate exposure.