Coding assistants can be tricked by malicious symlinks

A shortcut is great—unless it sends you off a cliff. That applies both to cross-country road trips and AI coding assistants used to generate software.

In a July blog posting, Maor Dokhanian, a threat researcher at cloud and AI security tools provider Wiz, discussed the discovery of a systematic vulnerability, dubbed GhostApproval, that occurred in six of the top AI coding assistants.

The affected coding assistants included Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The vulnerabilities could allow malicious actors to trick the agent into “accessing arbitrary files outside the workspace sandbox, potentially achieving remote code execution on the developer’s machine,” Dokhanian wrote.

Diagnostic breakdown. Dokhanian told IT Brew that he was experimenting with AI assistant coding features when he discovered the ability to plant a symbolic link as a vector for a cyberattack; symlinks, as they’re also known, store a shortcut to another location or file.

Dokhanian set off to plant a malicious symlink to see how AI agents and AI coding assistants would react. For example, the symlink could present as an innocent-sounding file, such as a configuration file for software settings like configuration.json, but redirect to a sensitive file in another part of the user’s system. From there, Dokhanian said, the attacker could set up a repository with malicious code, along with a README file with instructions for the agent to write a few lines of code into that sensitive file, allowing the remote-code execution.

In a hypothetical case, an attacker could use this to access pretty much any kind of sensitive information available on the victim’s PC. “When a victim clones this repository and asks their AI assistant to ‘set up the workspace’ or ‘follow the README,’ the agent reads the instructions and writes the attacker’s SSH public key—not to a local config file, but to the victim’s `~/.ssh/authorized_keys`,” read Wiz’s blog posting. “In some cases, this write happens before the user even sees a confirmation dialog. The attacker now has persistent, password-less SSH access to the victim’s machine.”

No interference, please! In his post, Dokhanian wrote that while many AI coding assistants have sandboxes or confirmation dialogues to prevent this style of attack, it can cloak such dialogues as a “harmless local edit.”

Despite the current discussion about humans in the loop preventing AI attacks, Dokhanian told IT Brew this attack demonstrates how a human isn’t always a fail-safe cybersecurity measure.

Coding considerations. Cybersecurity concerns around symlinks have existed for years, but the race to produce new AI coding features could bring them back to the forefront. “So many tools are racing between themselves, and I guess sometimes they lose sight of more basic and important issues to take into consideration, and how to deal and detect those issues,” Dokhanian said.

When it comes to best cybersecurity practices, Dokhanian recommended that IT pros look for AI coding tools that feel comfortable and safe; when new threats arise, they should consider disabling coding assistants or changing governance protocols.

“Developers might give [coding tools] full permission to run any tools and any changes over any files in the system, and others would allow features that are more strict,” he said. “I would try to stick to the most strict side and really try to audit everything these tools do, as they really are so privileged and able to do so many things over the system.”