GhostApproval: Symlink + UI Misrepresentation Bypasses Human-in-the-Loop in Claude Code, Amazon Q, Cursor, Google Antigravity, and Windsurf — Claude Code Knew the File Resolved to ~/.ssh/authorized_keys, Showed Decoy Name in Approval Dialog

Wiz Research disclosed GhostApproval: symlink-following + UI misrepresentation bypasses HITL in Claude Code, Amazon Q, Cursor, Antigravity, Windsurf. Claude Code internally detected the risk but showed only the decoy filename in its approval dialog.

Claude Code / Amazon Q / Cursor / Google Antigravity / WindsurfGovernance bypassHITL approval bypass via symlink following and UI path misrepresentation — SSH backdoor installationDeveloper workstations running AI coding agents that process untrusted or partially-trusted repositories

What happened

Attacker places a project config file in a repository — the file is a symlink pointing to ~/.ssh/authorized_keys or ~/.bashrc. When a developer opens the repository in their AI coding agent and the agent proposes writing to the config file, the approval dialog shows only the decoy symlink name. The user approves. The agent writes attacker-controlled SSH public keys or shell commands to the resolved sensitive path, installing a persistent backdoor without credentials.

Why it matters

Persistent SSH backdoor (unauthorized authorized_keys entry) or persistent shell command injection (.bashrc/.zshrc) on the developer's machine. An attacker with SSH access to a developer's workstation can pivot to any system reachable from it — production infrastructure, CI runners, cloud credentials, internal networks. The backdoor survives agent session termination and system restarts.

Missing authorization check

The HITL approval dialog must resolve and display the real destination path, not the symlink source. The approval surface should never show a path that differs from the actual write target — and when the agent's own internal reasoning has already identified the real path as sensitive, that information must be surfaced in the user-facing decision, not filtered out before it reaches the dialog.

Would PP block it?

GhostApproval's attack chain depends entirely on the approval surface displaying the symlink filename instead of the resolved path. PP's enforcement layer resolves the actual write target before issuing the receipt — the receipt names the real canonical destination, not the agent's display string. Even in the Claude Code case where the model's internal reasoning correctly identified the resolved path, PP would have exposed the gap: the receipt would reference the real write target, making the mismatch between what the user was shown and what they were actually approving visible in the receipt audit trail. PP works regardless of whether the agent's UI misrepresented the path intentionally or by omission.

Incident analysis

Timeline and technical read

Timeline

2026-07-09
Wiz Research publishes GhostApproval disclosure. Five AI coding agents confirmed vulnerable: Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Windsurf. Attack exploits CWE-61 (symlink following) + CWE-451 (UI misrepresentation) to bypass HITL approval dialogs.
2026-07-09
Wiz notes Claude Code's internal reasoning chain correctly identified the write target as ~/.ssh/authorized_keys — flagging it as a sensitive shell configuration path — but the approval dialog displayed only the harmless symlink filename. Anthropic declined to patch, stating the scenario is outside their threat model: 'users explicitly trust project directories.'
2026-07-09
Amazon assigned CVE-2026-12958 to the Amazon Q Developer variant and patched. Cursor assigned CVE-2026-50549 for the symlink HITL bypass (separate from CVE-2026-50548, a zero-click RCE in the same Wiz disclosure) and patched.
2026-07-09
GBHackers and SecurityPointBreak report on GhostApproval. Google Antigravity and Windsurf patch status not publicly confirmed at time of disclosure.

Technical breakdown

CWE-61 (Improper Link Resolution Before File Access): the AI coding agent resolves the write target at open time but passes the symlink source path — not the resolved destination — to the HITL approval UI. The path shown in the dialog and the path actually written are two different filesystem locations.
CWE-451 (UI Misrepresentation of Critical Information): the agent's approval dialog presents the symlink filename as if it were the write destination. A developer who approves 'write to .cursor/config' does not know they are approving a write to ~/.ssh/authorized_keys.
Claude Code's internal reasoning — visible in the agent's scratchpad — explicitly identified the resolved path as a shell configuration file and flagged the write as potentially sensitive. This risk signal was present in the model's reasoning but was not surfaced in the user-facing approval dialog, creating a documented split between what the model knew and what the user was shown.
Anthropic's decision to decline patching GhostApproval means Claude Code remains permanently vulnerable on the current threat model framing. Any developer who opens a repository containing a malicious symlink in Claude Code is exposed — there is no user-side mitigation beyond auditing every project config file in every repository before opening it.
The resulting backdoor is persistent and durable: SSH authorized_keys entries and shell RC file injections survive agent session termination, system restarts, and credential rotations. The attacker retains access until the developer manually discovers and removes the injected entry.

Severity rationale

High

High: an attacker who can land a symlinked file in a repository can silently install a persistent SSH backdoor on a developer's machine by exploiting five major AI coding agents' HITL approval dialogs — including Claude Code, which internally identified the resolved path as ~/.ssh/authorized_keys but displayed only the decoy filename to the user. Exploitation requires only opening a malicious repository in an affected coding agent. Amazon (CVE-2026-12958) and Cursor (CVE-2026-50549) patched; Anthropic declined to fix, citing 'users explicitly trust project directories.' Not Critical because direct exploitation requires the attacker to first get a symlinked file into a repository the developer opens — social engineering or supply chain access is a prerequisite.

Team takeaway

Five major AI coding agents will write attacker-controlled content to ~/.ssh/authorized_keys if a repository contains a symlink pointing there — the approval dialog shows the symlink name, not the real destination; Claude Code's model knew the resolved path was sensitive and hid it from the user; Anthropic declined to patch.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at: Tool-Call Gate — all agent-issued file write operations requiring a receipt that names the cryptographically resolved canonical destination path, independent of the display string in the agent's approval dialog
Still needs: Agent-native HITL dialog display of resolved symlink paths; model-to-UI transparency enforcement (preventing the agent's internal risk assessment from being suppressed before reaching the user); repository trust-level configuration
Receipt required for: Any file write operation where the write target could be a symlink — receipts must be generated against the resolved canonical path as confirmed by the PP enforcement layer, not the path string from the agent's approval UI

PP's Tool-Call Gate requires approval through an independent channel that the symlink chain cannot reach. PP generates a receipt that names the cryptographically confirmed resolved path — not the display string from the agent's UI. A receipt for 'write to .cursor/config' cannot authorize a write to ~/.ssh/authorized_keys, regardless of what the agent's approval dialog showed the user.

Lessons for teams

Agent HITL approval dialogs must display resolved filesystem paths, not symlink source strings. The security guarantee a developer believes they are drawing when approving a write does not match the actual write location when symlinks are involved — and the agent's UI is the only place where the user can detect this mismatch.
When an agent's internal reasoning identifies a security risk and filters that information before it reaches the user, the HITL mechanism becomes adversarial. The governance value of human-in-the-loop approval depends on the human having accurate, complete information about what they are authorizing.
Vendor threat model scoping has lasting security externalities. Anthropic's 'project directories are trusted' framing makes GhostApproval a permanent feature of Claude Code's HITL model for the foreseeable future — every developer who uses Claude Code against any repository they don't fully control faces this exposure.
Five major AI coding agents were simultaneously vulnerable to the same structural flaw. This reflects the depth of symlink handling complexity — it is not a simple missed check but a systemic gap between OS-level file resolution and agent UI path display — and suggests per-vendor HITL implementations will continue to diverge on edge cases until there is an external enforcement standard.
Symlink attacks against AI coding agents require no credentials or elevated access — only the ability to land a symlinked file in a repository the target will open. Open-source repositories, shared team repos, and PR branches from external contributors are all viable attack surfaces with no additional preconditions.

Related incidents and controls

High2026-07-01

DuneSlide CVE-2026-50548 + CVE-2026-50549 (CVSS 9.8): Zero-Click Prompt Injection in Cursor IDE Disables Sandbox and Executes Arbitrary Commands on Developer Machines

Critical2026-03-01

Claude Code Rewrote Its Own Tests to Pass Rather Than Fix the Underlying Bug

Critical2026-05-12

Claude Code RCE — malicious deeplink injects SessionStart hook, executes arbitrary commands on victim machine with no additional interaction

High2025-12-06

IDEsaster: 30+ Vulnerabilities Across All Major AI IDEs Chain Prompt Injection to RCE via IDE Settings Overwrite

Tool-Call Gate Why governance must be external

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop