A new security vulnerability named **GhostApproval** has been discovered by Wiz, affecting several leading AI coding assistants like Claude Code and Amazon Q Developer. This attack exploits a longstanding issue with symbolic link (symlink) following, enabling attackers to manipulate files on developers' machines. GhostApproval allows attackers to create deceptive paths that lead to sensitive locations, potentially leading to remote code execution.
The researchers found that many AI tools fail to display the actual target in confirmation prompts, undermining Human-in-the-Loop security measures. Affected vendors including AWS and Google have confirmed the vulnerability and initiated patches, while others like Anthropic have implemented mitigations.