If you use an AI coding agent on repositories you did not create, check its version before opening the next workspace. As of 2026-07-20, AWS, Cursor, and Google have fixes listed for the GhostApproval pattern. Claude Code has added relevant symlink protections, while Augment and Windsurf had no confirmed fixed version in the original disclosure.
Which tools were affected?
Wiz disclosed GhostApproval on July 8, “2026” after testing six assistants. The issue is a trust-boundary gap involving symbolic links: a repository can contain an ordinary-looking path that resolves to a sensitive file outside the workspace. The agent may then show the developer the local-looking path in an approval prompt while its file operation reaches the resolved target.
That distinction matters because an approval dialog is useful only when it accurately describes the action being authorized. In some tested products, the write occurred before the interface offered an Accept, Reject, or Undo control. This is not a claim that every user of an affected version was compromised; Wiz reported a vulnerability pattern and said it had no evidence of exploitation in the wild.
| Tool | Affected or tested version | Fixed version or status as of 2026-07-20 |
|---|---|---|
| Amazon Q Developer | AWS Language Server before 1.69.0; VS Code plugin before 2.20; JetBrains before 4.3; Eclipse before 2.7.4; Visual Studio toolkit before 1.94.0.0 | Fixed in Language Server 1.69.0 and the listed plugin versions, per the AWS security bulletin |
| Cursor | Versions before 3.0 | Fixed in 3.0, per the Cursor security advisory for CVE-2026-50549 |
| Google Antigravity | Wiz did not publish an affected-version range | Wiz lists 1.19.6 as fixed; no linked Google advisory or CVE was available in the disclosure |
| Claude Code | Wiz tested 2.1.42 | Anthropic rejected the report as outside its threat model. Wiz says 2.1.173 and later resolve symlinks and warn before sensitive writes; Anthropic said a symlink warning had shipped in 2.1.32 |
| Augment | Wiz tested 0.754.3 | No fixed version confirmed; Wiz marked the response “In Progress” |
| Windsurf | Wiz tested 1.9566 | No fixed version confirmed; Wiz marked the response “In Progress” |
AWS assigned the symlink-validation issue CVE-2026-12958. Its June 23 bulletin says the language server normally updates automatically, but restricted networks can prevent that update. Reloading the IDE should trigger it; where automatic updates are blocked, AWS recommends updating the relevant Amazon Q plugin.
Cursor’s advisory is more explicit: releases before 3.0 are affected, and 3.0 contains the fix. The advisory describes path canonicalization—the process of resolving a path to its actual destination—as the failed boundary check.
What developers should do now
First, verify the installed version rather than assuming an auto-updater completed. For Amazon Q, check both the IDE plugin and its bundled language server where your environment exposes both. Cursor users should be on 3.0 or later. Claude Code users should update to the latest available release; the version numbers above describe the protections reported by Wiz, not an Anthropic-issued GhostApproval CVE.
For Antigravity, Augment, and Windsurf, the safest reading is narrower: do not infer a patch that the vendor or disclosure has not documented. Until your installed release is covered by a vendor advisory, avoid running the agent against untrusted repositories on a workstation that holds valuable credentials. Use an isolated development environment, keep approval bypass modes off, and inspect repository symlinks before allowing agent-driven writes.
Who needs to act first
You are in the highest-relevance group if you open repositories you did not create on a workstation that also holds valuable credentials. The issue starts with a repository-controlled symbolic link and ends at a path outside the workspace, so the important boundary is not whether you trust the model. It is whether you trust the repository and whether the agent can reach anything valuable beyond it.
If you work only in repositories you created, the immediate exposure described here is narrower, but the version check still has value. It tells you whether the product has the path handling its vendor or the disclosure identifies as fixed. It also keeps you from carrying an older installation into the next outside repository.
Team administrators have a separate problem: an auto-update setting is not the same as a verified installed version. That is especially clear for Amazon Q, where the IDE plugin and bundled language server both matter and a restricted network can prevent the normal update. Your job is to verify the deployed components, not merely the update policy.
A workspace-opening checklist
- Identify the assistant and installed version. Compare it with the exact row in the table rather than treating all six products as if they shared one fix.
- For Amazon Q, check both exposed components. Confirm the relevant IDE plugin and the AWS Language Server. If a restricted network blocked the normal update, reload the IDE and follow the documented plugin-update route.
- For Cursor, treat 3.0 as the boundary stated by its advisory. A release before 3.0 is not covered by that fix.
- For Claude Code, distinguish the reported protections from a vendor CVE. Update to the latest available release, but do not describe the listed versions as an Anthropic-issued GhostApproval fix.
- For Antigravity, Augment, or Windsurf, look for a documented status before inferring one. The disclosure did not provide the same kind of confirmed fixed-version story for all three.
- Before agent-driven writes, inspect repository symlinks. Keep approval bypass modes off and use an isolated development environment when the repository is untrusted.
The checklist is intentionally product-specific. A single “all tools updated” box can hide the exact mismatch GhostApproval exploits: the path shown to you may not be the path the operating system reaches.
Common misreadings
An approval prompt is not sufficient by itself. The reported problem is that the displayed local-looking path can differ from the resolved target, and in some tested products the write occurred before Accept, Reject, or Undo appeared. The quality of the prompt cannot repair that ordering or path-resolution gap.
“No evidence of exploitation in the wild” also does not mean the affected versions were safe. It limits what Wiz claimed about observed attacks; it does not erase the vulnerability pattern the testing found.
A fixed version for one product does not settle the status of another. AWS and Cursor published explicit version boundaries, while the descriptions for Antigravity, Claude Code, Augment, and Windsurf contain different levels of vendor confirmation. Read each row on its own terms.
Finally, updating is not a reason to merge untrusted workspaces with host credentials. The immediate patch and the broader isolation practice address different parts of the same trust boundary. The first corrects documented product behavior; the second limits what an untrusted repository can put within reach.
GhostApproval is not primarily a model-quality failure. It is an enforcement and interface problem between the path the developer sees, the path the operating system resolves, and the moment a write occurs. Updating is the immediate action; keeping untrusted workspaces separated from host credentials remains useful even after a vendor patch.