GhostApproval: AI Coding Tools Alter Files Outside Sandbox

A new technique called "GhostApproval" can trick AI coding assistants. Malicious code repositories can use this method to alter files outside their intended workspaces. Here's how it works: a malicious repository contains a README file. This file tells the AI to edit a file within the repo. However, this file is actually a symbolic link to another sensitive file on the victim's machine. This means the AI writes to a file outside its safe area. Researchers demonstrated how an attacker could write their SSH public key to a victim's authorized_keys file. This would give the attacker SSH access to the victim's system. Six different AI coding assistants were tested. All of them performed the file write without properly warning the user. These included Amazon Q Developer, Anthropic Claude Code, Augment Code, Cursor, Google Antigravity, and Windsurf. Amazon Web Services, Anthropic, Cursor, and Google have since issued fixes. One company, Augment Code, stated it does not consider GhostApproval a vulnerability. This matters because it highlights a new security risk for users of AI coding tools.