GhostApproval and GitLost: The Week AI Coding Agents Became the New Attack Surface

The week of July 7, 2026, will be remembered as the moment AI coding agent security went from theoretical concern to demonstrated exposure. Three separate research groups — Wiz Research, Noma Labs, and a team from Tel Aviv University and Technion — each published vulnerabilities in the most widely used AI coding assistants, all within two days.

The three attacks exploit different mechanisms — symbolic links, prompt injections in GitHub issues, and hallucinated repository names. But they share a common root cause: when an AI agent has permission to read, write, and execute on behalf of a user, any source of input the agent trusts becomes an attack vector.

GhostApproval: A Unix Classic Haunts AI Agents

Wiz Research published what it calls “GhostApproval” — a systematic vulnerability pattern affecting at least six AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack exploits something that has been a security headache since the early days of Unix: symbolic links.

The attack is deceptively simple. An attacker creates a malicious repository containing a symlink that points from what looks like a harmless config file (project_settings.json) to a sensitive system file (~/.ssh/authorized_keys). The README instructs the victim’s AI agent to “set up the workspace” by writing SSH public keys to the config file. The agent follows the symlink and writes the attacker’s key to the real SSH authorized_keys file, granting persistent remote access to the victim’s machine.

What makes GhostApproval particularly insidious isn’t the symlink itself — it’s that the confirmation dialogs hide the real target. Wiz found that while many of these coding assistants internally recognized the symlink pointed to a dangerous location, the approval prompt displayed the symlink name (project_settings.json) rather than the actual target (~/.ssh/authorized_keys). As Wiz researcher Maor Dokhanian wrote: “The user approves what they believe is a harmless local edit; the agent writes to a sensitive file outside of the project workspace.”

Anthropic’s Claude Code was the worst offender. Its internal reasoning revealed: “I can see that project_settings.json is actually a zsh configuration file.” Yet it still showed the user a prompt asking to edit project_settings.json. Anthropic’s response — that the scenario “falls outside our current threat model” — highlights a worrying trust-boundary debate in the industry.

The response from vendors tells you everything. Amazon classified it as a high-severity pre-authorization write bug (CVE-2026-12958) and fixed it. Cursor issued CVE-2026-50549 and fixed it in v3.0. Google deemed it critical in Antigravity and deployed a fix. Augment and Windsurf acknowledged the report but have not yet patched. Three vendors treated it as a vulnerability; two others, including Anthropic, classified it as out-of-scope.

GitLost: The Lethal Trifecta

One day earlier, Noma Labs disclosed GitLost, a critical prompt injection vulnerability in GitHub’s Agentic Workflows — the natural-language workflow system GitHub launched in February 2026.

The attack requires no coding skills, no credentials, and no special access. An attacker opens a GitHub Issue on a public repository belonging to any organization using GitHub Agentic Workflows. The issue body contains plain-English instructions (disguised as a routine business request from “sales leadership”). The AI agent reads the issue, fetches README files from private repositories the organization owns, and posts their contents as a public comment.

Noma’s Sasi Levi called the combination “the lethal trifecta”: access to sensitive data, exposure to untrusted content, and an available exfiltration path. The researchers bypassed GitHub’s guardrails by adding a single keyword — “additionally” — that triggered the model to follow instructions it had previously refused.

GitHub’s proposed fix was a documentation callout advising users on credential hygiene. As of publication, no code-level fix has been shipped. Levi’s framing is worth repeating: “To agentic AI, indirect prompt injections are the equivalent of SQL injections in web applications.”

HalluSquatting: The Third Vector

A third group from Tel Aviv University published HalluSquatting on the same day — though we covered that technique in detail in our earlier post. In brief: AI coding assistants hallucinate repository locations up to 85% of the time for recently-published tools, and attackers can pre-register those hallucinated names to deliver botnet malware through nine different coding tools.

The Pattern: Trust Boundaries Don’t Exist Yet

What connects these three disclosures is a structural weakness, not a code bug. AI coding agents operate with a fundamental permission mismatch:

1. Broad access — agents run with the user’s full credentials, file system access, and network permissions

2. Untrusted inputs — agents ingest content from README files, GitHub Issues, PR descriptions, web pages, and chat history

3. Autonomous execution — agents can write files, run commands, clone repositories, and install packages with or without confirmation

The security industry spent two decades learning that SQL injection was about treating user input as executable code. The same lesson is playing out now with AI agents, except the “code” being executed is not a SQL query — it’s a file write, a terminal command, or a repository clone.

Noma’s Sasi Levi put it most sharply: “The agent’s context window is also its attack surface. Any content the agent reads can be weaponized if the agent treats that content as instructional input.”

What Teams Should Do Right Now

Revoke broad agent permissions. No AI coding agent should have read access to every repository in your organization. Explicit repository whitelists, not service account access. Security researcher Vibhum Dubey: “Agents get explicit repository whitelists, not broad service account access.”

Treat all user-generated content as untrusted input. GitHub Issues, PR descriptions, README files, comments — every text source an agent ingests is a potential injection vector. Wiz’s Dokhanian: “Human-in-the-loop isn’t always the safety net it appears to be. When the confirmation prompt hides critical information, the approval becomes a rubber stamp.”

Ban auto-run modes. Claude Code’s skip-permissions flag, Gemini CLI’s yolo mode, and similar “just do it” settings are the on-ramp for supply-chain attacks. If your agent can execute fetched code without confirmation, you’ve already lost.

Verify before you fetch. The simplest fix for HalluSquatting is also the most effective: make the agent search for a repository before cloning it. A real lookup grounds the agent in what actually exists and cuts the guessing.

Build a kill switch. Dubey again: “Most teams can disable a compromised API key. Can you disable a rogue agent?”

What Comes Next

The most telling detail in this week’s disclosures is the vendor response split. Amazon, Google, and Cursor treated the symlink vulnerability as a critical security flaw and patched it within weeks. Anthropic argued it was the user’s responsibility to trust only safe directories. Augment and Windsurf acknowledged the issue without shipping a fix.

That split tells the market how each vendor will respond when the next — and more damaging — agent vulnerability surfaces. And there will be a next one. As the Tel Aviv researchers wrote: “Attacks always get better; they never get worse.”

The AI coding agent market is betting that frictionless autonomy is worth the security risk. This week, three independent research groups demonstrated the cost of that bet. The question isn’t whether agents will be exploited in production — three separate attack chains are already published. The question is which vendor will take the first real production hit before the industry changes course.

Coding agents are the most powerful developer tool since the IDE. But power without trust boundaries is just a new class of vulnerability waiting to be weaponized at scale.