One Symlink Trick Fooled Six AI Coding Agents Into Writing Outside Their Sandbox
Wiz Research disclosed a technique it calls GhostApproval on July 9, 2026: a malicious repository containing a symlink, a fake config file like project_settings.json that actually points somewhere sensitive, such as ~/.ssh/authorized_keys, can trick an AI coding agent into writing outside the sandbox it claims to enforce. The finding tested against six major tools, Claude Code, Cursor, Amazon Q Developer, Augment, Google Antigravity, and Windsurf, and it worked against all of them.
A class, tested across the whole category
That's the part worth sitting with. This isn't one vendor's implementation bug, it's a technique that succeeded against every major tool in the category Wiz tested it on. When a sandbox-escape method works uniformly across competing products built by different teams, it usually means the underlying assumption, that a config file inside a repo is safe to trust and follow, is the actual flaw, shared by the whole category's design pattern rather than any single company's code.
Patch status six months in is inconsistent enough to matter for anyone evaluating these tools today. Amazon Q Developer and Cursor had patches out at disclosure. Claude Code's vendor disputed the finding rather than confirming a fix. Augment, Google Antigravity, and Windsurf had pending status. No CVE was assigned despite the finding being rated trivially exploitable, which means this won't show up in a standard vulnerability scan or CVE-based vendor questionnaire.
What to actually check
If your team uses any AI coding agent that claims sandboxed execution, ask specifically whether the vendor has addressed symlink-based sandbox escapes, by name, not just "do you have a sandbox." Given no CVE exists to point to, you'll need to ask the specific technical question directly rather than relying on a vulnerability database turning it up for you. A tool's marketing claim of "sandboxed by design" is doing less work than it sounds like until you've confirmed this specific class of bypass has actually been closed.