GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf
GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf is a high-severity remote code execution issue in Symlink Bypass Hits Claude Code, Cursor, Windsurf, an AI agent.
Is Symlink Bypass Hits Claude Code, Cursor, Windsurf running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf- Severity
- high
- Attack type
- Remote code execution, Path traversal, Sandbox escape
- Component
- Cursor · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Wiz Research disclosed GhostApproval, where a malicious repo plants symlinks that AI coding assistants fail to resolve before writing, so an approved write to a harmless-looking path actually lands on a sensitive system file, enabling RCE. It affects Amazon Q, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf; at disclosure Augment and Windsurf had not shipped complete fixes.
Am I affected by this vulnerability?
You are affected if Symlink Bypass Hits Claude Code, Cursor, Windsurf is installed or configured on a machine. Check the references for the exact versions.
How do I fix it?
Update Cursor, Amazon Q, and Antigravity to patched builds and require canonical path resolution plus explicit approval before any agent file write.
How do I find every machine running Symlink Bypass Hits Claude Code, Cursor, Windsurf?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Symlink Bypass Hits Claude Code, Cursor, Windsurf and which version, then enforce a policy on it.