GhostApproval is a vulnerability pattern in AI coding assistants where a symlink can make a benign-looking file prompt actually target a sensitive destination like ~/.ssh/authorized_keys. Researchers demonstrated the issue in Claude Code, Cursor, and Google’s Antigravity, and also showed that some approval dialogs can display misleading paths or even approve changes after the write has already happened. #GhostApproval #ClaudeCode #Cursor #Antigravity #authorized_keys
Keypoints
- GhostApproval abuses symlinks to hide the real file destination from users.
- Attackers can use a poisoned repository README to trick an agent into making the write.
- The victim may think they are editing project_settings.json while the agent writes to ~/.ssh/authorized_keys.
- Researchers found UI issues in Claude Code, Cursor, and Google’s Antigravity.
- Defenses include scanning for symlinks, checking resolved paths, and sandboxing agents.
Read More: https://www.toxsec.com/p/ghostapproval-when-the-approval-prompt