GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents - IT Security News
2026-07-09
IT Security News - cybersecurity, infosecurity news
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Researchers at Wiz discovered a vulnerability, dubbed GhostApproval, affecting six popular AI coding assistants. The flaw allows malicious repositories to exploit symlink handling, tricking AI agents into editing files outside their sandbox, potentially enabling remote code execution and unauthorized access on developers' machines. Some vendors have patched the issue.[AI generated]
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions AI coding assistants, which are AI systems designed to assist in coding tasks. The flaw allows malicious repositories to run code on the developer's machine without proper authorization, which constitutes a direct harm to property and security. Since the AI systems' malfunction (the symlink flaw) directly leads to this harm, this qualifies as an AI Incident under the definition of harm to property caused by AI system malfunction.[AI generated]