GhostApproval Vulnerability Exposes Critical Flaw in Major AI Coding Assistants A newly identified vulnerability, dubbed GhostApproval, has revealed a systemic security flaw in six widely used AI coding assistants Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf allowing attackers to bypass human-in-the-loop (HITL) safety controls and potentially achieve remote code execution on developers' machines. Discovered by Wiz researchers, the exploit leverages symbolic link following (CWE-61), a technique historically used in Docker escapes and privilege escalation attacks but now repurposed to target AI coding tools. The attack is deceptively simple: an attacker crafts a malicious repository containing a symlink (e.g., project_settings.json → ~/.ssh/authorized_keys). When a developer clones the repo and instructs their AI assistant to "set up the workspace," the agent follows the symlink, writing the attacker’s SSH public key directly to the victim’s authorized_keys file, granting persistent, password-less access. What makes GhostApproval particularly insidious is its UI misrepresentation layer (CWE-451). In testing, Anthropic’s Claude Code demonstrated this flaw: while the agent’s internal reasoning correctly identified the symlink’s true target (e.g., a zsh configuration file), the user-facing prompt merely asked, "Make this edit to project_settings.json?" This discrepancy turns HITL safeguards into a false sense of security, as users unknowingly approve malicious actions. ### Vendor Responses & Patches Three vendors issued fixes: - Amazon Web Services (AWS) patched the issue in language server v1.69.0 (May 27, 2026, CVE-2026-12958). - Cursor released a fix in v3.0 (June 5, 2026, CVE-2026-50549). - Google (Antigravity) deployed a fix on May 22, 2026, though it has not yet assigned a CVE. Augment and Windsurf acknowledged the reports but had not fully addressed the issue at the time of disclosure. Windsurf’s pre-authorization variant was especially dangerous, as the agent wrote files to disk before displaying the confirmation dialog, effectively making the prompt an "undo" rather than a security gate. Anthropic initially rejected the report, arguing that user-trusted directories and approved prompts shifted responsibility to the end user. However, after further review, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files a change that had been implemented in v2.1.32 (February 5, 2026) as part of internal security hardening. ### Mitigation Recommendations Wiz researchers outlined three key defenses for AI coding tool vendors: 1. Resolve symlinks before displaying prompts always show the canonical target path. 2. Warn explicitly when resolved paths exit the workspace writes to ~/.ssh/authorized_keys should be visibly distinct from those to ./config.json. 3. Never write to disk before explicit user authorization confirmation dialogs must act as security gates, not undo mechanisms. The vulnerability was first discovered on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure occurred on July 8, 2026, following a 90+ day coordinated disclosure window. GhostApproval highlights a category-level design gap in AI coding assistants, where HITL controls intended as a last line of defense can be systematically bypassed. As AI agents gain greater autonomy over developer filesystems, the integrity of these controls must be treated as a first-class security requirement.

New Supply Chain Attack Targets AI Developers with Malicious npm Package A sophisticated supply chain attack emerged on March 20, 2026, when a threat actor published a malicious npm package, gemini-ai-checker, under the account gemini-check. Marketed as a utility to verify Google Gemini AI tokens, the package contained hidden malware designed to steal credentials, files, and tokens from AI coding environments. The package’s README mimicked a legitimate JavaScript library, chai-await-async, though the two were unrelated a red flag many developers overlooked. Upon installation, the malware silently contacted a Vercel-hosted staging server (server-check-genimi.vercel.app) to download and execute a JavaScript payload directly in memory, evading traditional security tools. The attack was traced to OtterCookie, a JavaScript backdoor linked to the Contagious Interview campaign, attributed to North Korean (DPRK) threat actors. Microsoft documented a similar variant in March 2026, active since October 2025. The same actor maintained two additional malicious packages express-flowlimit and chai-extensions-extras sharing the same Vercel infrastructure. By publication, the three packages had been downloaded over 500 times combined, with gemini-ai-checker removed just before April 1, 2026, while the others remained active. This campaign uniquely targeted AI developer tools, including Cursor, Claude, Windsurf, PearAI, Gemini CLI, and Eigent AI, extracting API keys, conversation logs, and source code. The malware also stole browser credentials and cryptocurrency wallets, including MetaMask and Exodus. The infection mechanism was designed to evade detection. The package included 44 files and four dependencies, appearing legitimate with a SECURITY.md file. A hidden libconfig.js file split the command-and-control (C2) configuration into fragments, reassembled at runtime by libcaller.js to fetch the payload. The malware executed in memory using Function.constructor instead of eval to bypass static analysis. Once active, the payload deployed a four-module architecture, each running as a separate Node.js process connected to 216.126.237.71 on dedicated ports. Module 0 established remote access via Socket.IO, Module 1 targeted browser databases and cryptocurrency wallets, Module 2 scanned for sensitive files in AI tool directories, and Module 3 monitored the clipboard with a delayed startup to avoid sandbox detection. Defenders were advised to monitor outbound connections to Vercel and use Microsoft’s KQL queries to detect suspicious Node.js behavior. The incident underscored the risks of unverified npm packages and the need to treat AI tool directories with the same caution as sensitive system folders.

Malicious VS Code Extension Targets Developers via Solana Blockchain Cybersecurity researchers at Bitdefender have uncovered a sophisticated attack targeting developers through a malicious extension for the Windurf IDE, a popular coding environment. The threat disguises itself as a legitimate tool for the R programming language, using the filename reditorsupporter.r-vscode-2.8.8-universal a near-identical mimic of the trusted REditorSupport extension. Once installed, the malware leverages an unconventional command-and-control (C2) method: the Solana blockchain. Instead of relying on traditional servers, it retrieves encrypted JavaScript payloads from transactions on the Solana network, making detection and blocking more difficult. The malware then deploys files like w.node and c_x64.node to execute data theft. The attack is highly selective, performing system profiling to avoid infecting users in Russia likely to evade local law enforcement. For non-Russian targets, it steals passwords and session cookies from browsers like Google Chrome. To maintain persistence, it creates a hidden PowerShell task (UpdateApp) that reactivates the malware on system startup, ensuring continued access even if the IDE is closed. The campaign specifically targets developers due to their access to high-value credentials, such as API keys, which could grant attackers deeper access to corporate networks. The discovery highlights the growing risk of supply-chain attacks via trusted development tools.

Open VSX Marketplace Vulnerability Allowed Malicious Extensions to Bypass Security Scans A critical vulnerability in the Open VSX extension marketplace’s pre-publish scanning pipeline, dubbed "Open Sesame," allowed malicious extensions to bypass security checks and be published as "PASSED." The flaw was responsibly disclosed on February 8 and patched by February 11, demonstrating both the severity of the issue and the Open VSX team’s rapid response. Open VSX, used by platforms like Cursor and Windsurf as an alternative to Microsoft’s VS Code extension registry, introduced the scanning pipeline to detect malware, embedded secrets, suspicious binaries, and name-squatting attempts. The system required extensions to pass both synchronous and asynchronous scans before activation unless a scan failed, in which case the extension would be quarantined. However, a logic flaw in the scanning service’s boolean return value created a "fail-open" scenario. The system could not distinguish between no scanners configured (a valid case) and all scanner jobs failing (an error condition). Under heavy load, scan jobs would fail silently, and the system would interpret the ambiguous return value as "nothing to scan," automatically approving the extension. Exploiting the vulnerability required no special privileges any user with a free publisher account could trigger it by flooding the publish API with malicious extensions. Each upload would exhaust shared database resources, causing scan jobs to fail without being registered. The system then treated the failure as a successful scan, publishing the extension as verified. The impact was significant: malicious extensions could appear legitimate, posing a supply chain risk to developers. The Open VSX team addressed the issue by removing the ambiguous boolean logic and ensuring explicit failure handling, preventing automatic approvals when scans fail. This incident underscores the dangers of fail-open design in security systems, where ambiguous error handling can collapse critical safeguards under stress. The fix reinforces the principle that security-sensitive workflows should default to denial, not approval, when failures occur.