Your AI coding assistant could be rewriting your SSH keys without you ever seeing it. Wiz Research uncovered a “GhostApproval” flaw that lets a malicious project_settings.json symlink point at private keys, and the per-action approval dialog that pops up only shows the symlink’s name. Approve the dialog, and you’ve just handed the assistant unrestricted access to your credentials.

How the exploit works

  • An attacker adds a file called project_settings.json to a repository.
  • That file isn’t a regular JSON file; it’s a symbolic link (symlink) that redirects to the user’s ~/.ssh/id_rsa (or equivalent) private key.
  • When the developer asks the AI assistant to “set up the workspace,” the assistant follows the symlink and prepares to write to the real SSH key file.
  • The approval dialog that appears lists only project_settings.json. It does not resolve the symlink to show the actual path on disk.
  • Clicking “Approve” grants the assistant permission to modify the private key, effectively compromising the user’s identity on every service that trusts that key.

The bug appears in six widely used tools: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf. All of them show the same misleading dialog because the UI displays the name it receives, not the resolved target.

Why per-action dialogs aren’t enough

Per-action approval assumes a human can vet each operation an AI makes. In practice, it forces you to make perfect judgments every few seconds—something no one can do faster than the agent acts.

What vendors are doing – and why it matters

  • Amazon, Google and Cursor have already fixed it.
  • Anthropic (the maker of Claude Code) says users must approve only what they understand. That ignores the cognitive load of spotting symlinks and assumes users can audit every file path instantly—an unrealistic expectation.
  • Cursor also disclosed a separate issue, dubbed DuneSlide, that let attackers execute code on a machine without any approval prompt. The company patched that bug, showing how quickly these assistants can become attack vectors when permission checks are weak.

The split in responses raises a deeper question: should security be an after-the-fact dialog, or a pre-defined boundary that the assistant never crosses?

Scoped permissions: a practical alternative

Instead of prompting for each file operation, developers can set a scope for the assistant before it runs:

  • Define a directory tree (e.g., /src) that the AI may read or write.
  • Any attempt to touch files outside that tree—such as ~/.ssh/id_rsa—gets blocked by the operating system or a sandbox layer.
  • The scope is established once, cutting the number of decisions a human must make while still containing the assistant’s impact.

Scoping shifts the security model from “ask every time” to “allow only what’s needed.” It mirrors how container runtimes and mobile OSes sandbox applications, limiting damage when something goes wrong.

What to watch next

  • Vendor roll-outs: Keep an eye on update notes from the six affected tools.

Bottom line

The GhostApproval exploit proves that trusting a pop-up dialog gives a false sense of security. Until every AI coding assistant resolves symlinks and shows full paths, developers should enforce scoped write permissions—telling the assistant exactly where it can work before it starts. That simple change blocks the most dangerous class of attacks without adding click-fatigue.

Source: dev.to/girish_r/your-coding-agents-approval-dialog-is-lying-to-you-ih1