GhostApproval flaw hits six AI coding tools

Wiz discovered GhostApproval, a symlink vulnerability in six AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The flaw lets a malicious repository trick an agent into writing an attacker's SSH key to the victim's authorized_keys file, enabling remote code execution. Amazon, Cursor, and Google patched; Augment and Windsurf have not; Anthropic disputes the classification.