Six AI coding assistants just failed a 40-year-old Unix trick. Your developers are exposed.

Wiz just disclosed GhostApproval.

A systematic vulnerability across 6 major AI coding assistants.

Amazon Q. Claude Code. Cursor. Augment. Google Antigravity. Windsurf.

All vulnerable to the same attack. Symlink following. A trick that dates back to the 1980s.

Here is how it works:

Attacker creates a repo with a symlink disguised as a config file.

Points it to ~/.ssh/authorized_keys.

Developer clones the repo. Asks their AI agent to "set up the workspace."

The agent follows the symlink. Writes the attacker's SSH key to the developer's machine.

Password-less remote access. Game over.

But here is the part that should keep CISOs awake:

The confirmation dialogs HIDE the real target.

Claude Code's internal reasoning said: "I can see that project_settings.json is actually a zsh configuration file."

The user prompt said: "Make this edit to project_settings.json?"

The agent knew. The user didn't.

This is not a bug. This is a design philosophy failure. Human-in-the-loop only works if the loop gets accurate information.

Three vendors fixed it. Two went silent. Anthropic called it "outside our threat model."

If your engineering org uses any of these tools, audit your repo access controls today.

The next supply chain attack won't need malware. It will need a README file.

TITLE: Six AI coding assistants just failed a 40-year-old Unix trick. Your developers are exposed.

BODY:
Wiz just disclosed GhostApproval.

A systematic vulnerability across 6 major AI coding assistants.

Amazon Q. Claude Code. Cursor. Augment. Google Antigravity. Windsurf.

All vulnerable to the same attack. Symlink following. A trick that dates back to the 1980s.

Here is how it works:

Attacker creates a repo with a symlink disguised as a config file.

Points it to ~/.ssh/authorized_keys.

Developer clones the repo. Asks their AI agent to "set up the workspace."

The agent follows the symlink. Writes the attacker's SSH key to the developer's machine.

Password-less remote access. Game over.

But here is the part that should keep CISOs awake:

The confirmation dialogs HIDE the real target.

Claude Code's internal reasoning said: "I can see that project_settings.json is actually a zsh configuration file."

The user prompt said: "Make this edit to project_settings.json?"

The agent knew. The user didn't.

This is not a bug. This is a design philosophy failure. Human-in-the-loop only works if the loop gets accurate information.

Three vendors fixed it. Two went silent. Anthropic called it "outside our threat model."

If your engineering org uses any of these tools, audit your repo access controls today.

The next supply chain attack won't need malware. It will need a README file.