Approving a settings edit and authorizing an SSH key

Wiz Research describes a repository that ships a README telling the assistant to set up the project, next to a file named project_settings.json. The file is a symbolic link, and it resolves to the developer's ~/.ssh/authorized_keys rather than to a settings file; in the variants the researchers tried, it led to ~/.zshrc. The README's instructions ask the assistant to write to project_settings.json, and the write travels through the link and lands on the target.

The dialog that asks the user to approve the write names the benign file, not the target. Wiz calls the technique GhostApproval: the prompt displays one path and the write resolves to another. The user approves a settings edit and authorizes an SSH key.

The research covered six coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Three vendors fixed it promptly — AWS in language-server version 1.69.0, Cursor in 3.0, and Google in 1.19.6. Two identifiers are attached: CVE-2026-12958 for Amazon Q Developer and CVE-2026-50549 for Cursor, with a Google Antigravity identifier still pending at publication. Augment and Windsurf acknowledged the report and had not shipped a fix when the research went public.

Not every assistant failed the same way. In Claude Code the model's own reasoning named the real target — the transcript shows it noting that project_settings.json was actually a zsh configuration file — while the prompt the user saw still showed the decoy. Augment followed the link for reads as well as writes, exposing an out-of-workspace credentials file in the chat with no dialog at all. Windsurf went furthest: it wrote the change to disk before the Accept or Reject buttons had rendered, which leaves the dialog as an undo button rather than a gate. Amazon Q shared the pre-authorization shape, writing the payload immediately and offering only an Undo button after the fact.

Anthropic closed its report as Informative, placing the scenario outside its threat model: the user trusted the directory when starting the session and then approved the prompt, which in its reading makes the workspace the user's responsibility. The researchers' counter is that informed consent needs accurate information — a prompt that names project_settings.json while the write reaches ~/.ssh/authorized_keys cannot support a meaningful decision. Anthropic also pointed to a symlink warning it shipped in version 2.1.32 on 5 February 2026, nine days before the report was submitted, as unrelated hardening, and declined to say whether a later change that resolves symlinks and warns before writing to sensitive files was connected to the report.

Wiz's framing is a trust boundary gap layered on a known primitive: symlink following is decades old, and what Wiz says goes further is that the agent's own reasoning can recognize the dangerous target while the confirmation prompt conceals it. Nothing here needs a memory-corruption bug or a container break; the assistant does what it was told. The gap sits between what the approval screen represents and what the file system does with the approved name.