wiz · Crawled Jul 8, 2026
GhostApproval: A Trust Boundary Gap in AI Coding Assistants
1 IoCs 1 CVEs
Read original article ↗
AI Summary
GhostApproval is a trust boundary vulnerability affecting multiple AI coding assistants, where malicious repositories use symbolic links to trick agents into accessing or modifying files outside the intended workspace sandbox. The attack exploits symlink following (CWE-61) and UI misrepresentation (CWE-451), allowing adversaries to silently write to sensitive system files such as ~/.ssh/authorized_keys or ~/.zshrc. Despite confirmation prompts, users are often misled about the actual file being modified, leading to potential remote code execution and persistent access. Vendors including AWS, Cursor, and Google have issued fixes, while others have acknowledged or rejected the issue.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 1 extracted
| Type | Value | Detail |
|---|---|---|
| Filename | project_settings.json | Details → |
MITRE ATT&CK TTPs 8 techniques
T1005 Data from Local System · Collection T1059 Command and Scripting Interpreter · Execution T1059.003 Windows Command Shell · Execution T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.004 Cloud Account · Discovery T1542.001 System Firmware · Persistence T1548.003 Sudo and Sudo Caching · Privilege Escalation