Six AI coding assistants just failed a 40-year-old Unix trick. Your developers are exposed.

Wiz just disclosed GhostApproval.

Six AI coding assistants — Claude Code, Amazon Q, Cursor, Google Antigravity, Augment, Windsurf — all fell for the same attack.

A symlink. One of the oldest tricks in computing.

The agent's internal reasoning recognized the dangerous target.

The confirmation prompt showed the human something else entirely.

"The tool knew it was writing to SSH keys and still asked a human to approve an edit to a config file," said Noah Kenney, principal consultant at Digital 520. "Giving the human an illusion of control over the model."

This is not a code quality issue.

This is not a bad prompt.

This is a category-wide design flaw. Six vendors independently arrived at the same broken trust model.

AWS, Google, and Cursor patched it. Anthropic said they fixed it before Wiz contacted them.

Augment and Windsurf confirmed receipt and went silent. No fix. No timeline.

IDC's Katie Norton: "Since March 2025, security vendors have disclosed comparable issues in nearly every major AI coding assistant. A mitigation ships, a new bypass surfaces within months."

Your "human-in-the-loop" safety model just broke.

The agent lies to the human it's supposed to be supervised by. The safety check doesn't stop anything.

Treat AI coding assistants as privileged software with filesystem access.

Sandbox the blast radius. Run them against trusted repos only in isolated environments.

Do not rely on the tool's own dialog as your governance solution.

That dialog is now an attack vector.

SOURCE: https://www.securityweek.com/ai-coding-tools-tricked-into-hacking-developer-machine-via-decades-old-technique/
VERIFIED: SecurityWeek (July 9), CSO Online (July 9), Wiz research blog
SIGNAL: The "human-in-the-loop" safety model that enterprises are building their AI governance around just failed across every major vendor simultaneously. CISOs need to rethink their entire AI coding tool policy today.