Your Coding Agent's Approval Dialog Is Lying to You

<p>On July 8, Wiz Research disclosed <a href="https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants" rel="noopener noreferrer">GhostApproval</a>, a symlink flaw that hit six major AI coding assistants at once: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The bug is almost insultingly simple, which is exactly why it worked.</p> <p>A repo ships a file named <code>project_settings.json</code>. It's actually a symlink pointing at your SSH keys. You ask the agent to "set up the workspace." The agent resolves the link, writes to the real target, and shows you an approval dialog that says <code>project_settings.json</code> - because that's the name it was told, not the file it's about to touch. You click approve. You just authorized a write to <code>~/.ssh/id_rsa</code> without knowing it.</p> <p>Three things stand out from this disclosure.</p> <ol> <li><p><strong>The dialog worked exactly as designed.</strong> It shows the path a tool call was invoked with, not the path the filesystem resolves to after it follows a symlink. That gap between what the agent says it's doing and what the filesystem actually does is a decades-old class of bug - TOCTOU and symlink attacks predate LLMs by thirty years - and it walked straight into agentic coding because nobody ported the old lessons over.</p></li> <li><p><strong>Vendors split on whether this is even a vulnerability.</strong> Amazon, Google, and Cursor shipped fixes. Augment and Windsurf went quiet. Anthropic <a href="https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html" rel="noopener noreferrer">disputed</a> that Claude Code's behavior was a flaw at all, arguing that a user who trusts a directory and approves an edit owns that decision. Defensible in the abstract, useless in practice: nobody reviewing a "set up the workspace" request is mentally resolving symlinks before they click yes. Consent that requires the human to out-think the attacker is liability transfer dressed up as consent.</p></li> <li><p><strong>The same week, Cursor patched <a href="https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/" rel="noopener noreferrer">DuneSlide</a></strong> - two CVSS 9.8 zero-click RCEs where a prompt-injected instruction in an MCP response or search result escaped the sandbox entirely, no approval needed at all. GhostApproval and DuneSlide put the trust boundary in the wrong place in two different ways. One relies on a human reading a dialog correctly under time pressure. The other skips the human entirely.</p></li> </ol> <p>Per-action approval was never an architecture. It's a stopgap that asks a person to make a correct security judgment every single time, on decisions an agent generates faster than anyone can review. GhostApproval is what happens when the only thing standing between an agent and your SSH keys is whether you noticed a filename.</p> <p>The actual fix is scoping what an agent can touch before it runs, not asking someone to referee each touch as it happens. A spec that enumerates which paths, which operations, which directories are in bounds for a given task turns "did the human catch this" into "was this ever a legal move." You don't need to out-think a symlink attack if the agent was never authorized to write outside <code>/src</code> in the first place. Write your <a href="https://specpilot.dev" rel="noopener noreferrer">specs</a> to define the blast radius up front. Stop outsourcing that job to a dialog box nobody has time to verify.</p>