# symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce: SymJack: Symlink-Disguised File Copy Tricks AI Coding Agents into RCE

> SymJack: Symlink-Disguised File Copy Tricks AI Coding Agents into RCE is a high-severity remote code execution issue in Symlink-Disguised File Copy Tricks AI Coding Agents into, an AI agent. Affected: 6 AI coding agents tested (May 2026); all vulnerable.

- **Canonical URL:** https://catalog.anomity.ai/vuln/symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce
- **Aliases:** ti-031
- **Severity:** high
- **Attack type:** Remote code execution
- **Component:** Symlink-Disguised File Copy Tricks AI Coding Agents into (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-05-26
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce

## Summary

Adversa AI disclosed SymJack, a symlink-disguised file-copy operation that tricks AI coding assistants into arbitrary code execution while the agent's approval prompt misrepresents what is actually being approved, the human approves one benign-looking action but a different, dangerous one runs. All six agents tested were vulnerable: Claude Code, Cursor, Antigravity, GitHub Copilot, and Grok Build. It is the latest instance of the recurring "trust dialog" class of agent weaknesses.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| 6 AI coding agents tested (May 2026); all vulnerable | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run 6 AI coding agents tested (May 2026); all vulnerable.

## How do I fix it?

Treat agent approval dialogs as untrusted when operating on cloned or untrusted repositories. Validate the real target of file operations before approving. Disable autonomous file-copy and symlink following where possible. Keep agents updated as vendors ship trust-dialog fixes.

## How do I find every machine running Symlink-Disguised File Copy Tricks AI Coding Agents into?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Symlink-Disguised File Copy Tricks AI Coding Agents into and which version, then enforce a policy on it.

## References

- article: https://adversa.ai/blog/top-agentic-ai-security-resources-june-2026/

## Related vulnerabilities

- [CVE-2026-115726](https://catalog.anomity.ai/vuln/cve-2026-115726) — high
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [GHSA-632h-h47v-g4x4](https://catalog.anomity.ai/vuln/ghsa-632h-h47v-g4x4) — high
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and](https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and) — high
- [CVE-2026-82533](https://catalog.anomity.ai/vuln/cve-2026-82533) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce