GhostApproval: 6 AI Coding Assistants, One Shared Flaw

GhostApproval Hit Six AI Coding Assistants. The Disagreement Is the Real Story.

On July 8, 2025, Wiz Research dropped a disclosure that hit six of the most-used AI coding assistants in one shot. They called it GhostApproval, a symlink-based attack that tricks an AI agent into reading files it was never supposed to touch. Amazon Q, Claude Code, Augment, Cursor, Google's Antigravity agent, and Windsurf were all affected.

The reaction from vendors told you everything you need to know about the state of AI security. Amazon, Google, and Cursor shipped fixes. Augment and Windsurf said nothing publicly. And Anthropic, makers of Claude Code, disputed that it was a vulnerability at all, arguing that if a user chooses to trust a directory, what happens inside that directory is the user's decision. All of those responses can be simultaneously genuine. That is the problem.

What GhostApproval Actually Does

Symlink attacks are not new. They have existed since the early days of Unix. What makes GhostApproval interesting is not the technique, it is what it exposes about how AI coding agents handle trust.

The basic scenario: a malicious actor plants a symlink inside a directory the developer hands to their AI assistant. The symlink points somewhere the AI should not be reading, credentials, environment files, sensitive configuration. The AI agent follows the symlink without questioning it, because the parent directory was trusted.

The agent is not hacked. It is deceived. It does exactly what it is designed to do. That is what makes this category of attack so persistent, it does not require breaking the system. It requires understanding how the system thinks about trust, and then exploiting that model. Six vendors shipped agents that shared the same blind spot. They all built on top of the same implicit assumption: a trusted directory means trusted content.

The Patch Isn't the Story. The Disagreement Is.

When Wiz Research disclosed GhostApproval, the coordinated response should have been simple: acknowledge the attack surface, patch symlink traversal, ship an update. Three vendors did roughly that.

But Anthropic's response introduced something more interesting than a CVE. Their position was essentially: this is working as intended. Trusting a directory is the user's choice. The agent honors that choice. That is not a dismissal. It is a coherent security philosophy, one that puts responsibility on the developer to understand what they are trusting. Plenty of security professionals would agree with that framing in principle.

The trouble is that no two AI coding assistants share the same philosophy. Amazon patched it. Anthropic defended it. Cursor fixed it. Augment went quiet. If you ask five security engineers what the correct behavior should be when an AI agent encounters a symlink in a trusted directory, you will probably get three different answers. Now imagine you are a developer who uses Claude Code every day and has never thought about symlink traversal. Anthropic's response is technically defensible. It is not the answer you assumed was backing you.

You're Inheriting Someone Else's Threat Model

This is the real takeaway from GhostApproval, and it applies far beyond symlinks. Every AI coding assistant you use comes with a built-in set of assumptions about what counts as safe behavior. Those assumptions were made by engineers at a specific company, shaped by their particular interpretation of the threat landscape, their product priorities, their legal exposure, and their philosophy about user responsibility.

You do not get to read those assumptions. You just inherit them. Most of the time, this is invisible. Your assistant writes a function, you review it, you ship it. The underlying threat model never surfaces. GhostApproval made it visible, briefly, publicly, because six vendors happened to share a similar flaw, and one of them disagreed that it was a flaw at all. The next time the threat model surfaces, it might not come with a Wiz Research disclosure attached to it.

Cross-Model Review Isn't Just About Getting Better Code

The standard case for using multiple AI models is accuracy. Models disagree. One hallucinates where another does not. Comparing outputs catches errors. That is true.

But GhostApproval points to a second, less obvious reason to run your questions and your agent actions past more than one model: you do not want to be locked into a single vendor's definition of acceptable risk. If you are using only Claude Code, you are operating inside Anthropic's threat model. If you are using only Amazon Q, you are inside Amazon's. Each model brings its own version of "safe," trained into its behavior, baked into its defaults, expressed in how it handles edge cases you will never think to test.

When you run the same problem across multiple models, whether that is a code review, a security-sensitive query, or a decision about what to trust, you surface the places where those threat models diverge. That divergence is information. It tells you that the answer is not settled, that there is a judgment call being made somewhere, and that you should probably know about it before you ship.

This is exactly what Talkory was built for. When you run a query across ChatGPT, Claude, Gemini, Grok, and Perplexity simultaneously, you are not just collecting more answers, you are stress-testing the consensus. The Common Answer, the points every model agrees on, tells you where the ground is solid. The disagreements tell you where you are standing on someone's assumption. For security-adjacent decisions, how to handle credentials, what to trust in a repository, how to structure permissions, that signal matters. If four models give you one answer and one gives you another, you have not found the wrong answer. You have found a decision point that deserves more scrutiny.

What You Should Do Right Now

• Know which assistants you are running and what their patch status is. GhostApproval has patches available for Amazon Q, Claude Code (per Anthropic's eventual acknowledgment of the surface area), Cursor, and Google's affected tooling. Augment and Windsurf had not commented publicly as of disclosure. Check your vendors' security advisories.
• Don't treat "trusted directory" as a security boundary. It wasn't one before AI agents, and it isn't one now. Credential files, .env files, and configuration secrets do not belong in directories you are handing to an agentic tool.
• When your AI assistant makes a security-adjacent recommendation, don't treat one model's answer as ground truth. Run it past a second model. Note where they diverge. The divergence is the signal.
• Understand that your AI assistant has a security philosophy, and it might not match yours. Ask it directly: how do you handle symlinks in a trusted directory? What is your approach to file access when a user hasn't explicitly scoped permissions? The answers will tell you more than the vendor's marketing page.

The Bottom Line

GhostApproval is a symlink attack. Symlink attacks are not exotic. The reason this story matters is not the technical novelty, it is that six widely-used AI coding assistants were caught sharing the same assumption, and when researchers called it out, the vendors could not agree on whether it was a problem.

That disagreement is not a bug in the industry. It is a feature of how these products are built: each company making independent judgments about risk, shipping those judgments silently into tools that millions of developers use without reading the fine print. The next time you hand a directory to an AI agent, ask yourself: whose threat model is it using? And does it match yours?