SymJack: Symlink-Disguised File Copy Tricks AI Coding Agents into RCE
SymJack: Symlink-Disguised File Copy Tricks AI Coding Agents into RCE is a high-severity remote code execution issue in Symlink-Disguised File Copy Tricks AI Coding Agents into, an AI agent. Affected: 6 AI coding agents tested (May 2026); all vulnerable.
Is Symlink-Disguised File Copy Tricks AI Coding Agents into running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce- Severity
- high
- Attack type
- Remote code execution
- Component
- Symlink-Disguised File Copy Tricks AI Coding Agents into · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Adversa AI disclosed SymJack, a symlink-disguised file-copy operation that tricks AI coding assistants into arbitrary code execution while the agent's approval prompt misrepresents what is actually being approved, the human approves one benign-looking action but a different, dangerous one runs. All six agents tested were vulnerable: Claude Code, Cursor, Antigravity, GitHub Copilot, and Grok Build. It is the latest instance of the recurring "trust dialog" class of agent weaknesses.
Affected versions
| Affected | Fixed in |
|---|---|
6 AI coding agents tested (May 2026); all vulnerable | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run 6 AI coding agents tested (May 2026); all vulnerable.
How do I fix it?
Treat agent approval dialogs as untrusted when operating on cloned or untrusted repositories. Validate the real target of file operations before approving. Disable autonomous file-copy and symlink following where possible. Keep agents updated as vendors ship trust-dialog fixes.
How do I find every machine running Symlink-Disguised File Copy Tricks AI Coding Agents into?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Symlink-Disguised File Copy Tricks AI Coding Agents into and which version, then enforce a policy on it.