GhostApproval flaw tricks 6 coding agents into writing outside sandbox

A symlink-following flaw, tracked as CWE-61, lets malicious repos push coding agents to write files outside their sandbox, per cybersecuritynews.com. The risk lands on anyone who clones an unfamiliar repo into an agent workspace and reviews it with the agent's help. That's a common workflow, not an edge case.

Six agents are named in the advisory: Amazon Q, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The trick works because the approval prompt shows a path that looks safe. The agent then follows a symlink planted in the repo and writes somewhere else, so you approve a lie.

Symlink attacks are a known category, older than agent sandboxes themselves. Six separate teams built approval flows that don't resolve the link before showing the destination.

What the report doesn't say

The advisory doesn't say whether fixes have shipped for each of the six agents. It also doesn't say if this has been exploited outside research testing. Until vendors confirm otherwise, the approval screen on these six tools doesn't verify what it claims to.