Six major AI coding assistants have been found to share a flaw that turns their approval prompts into a rubber stamp, letting a malicious repository write to sensitive files on a developer's machine and, in the worst case, achieve remote code execution. Wiz Research named the flaw GhostApproval and found it in Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf. The technique relies on symbolic links, or symlinks, which make one file path secretly resolve to another. One Trusted Approval, One Hidden Target In a proof of concept (PoC) published on July 7, Wiz showed how a symlink inside a repository, disguised as an innocent file such as project_settings.json could actually point at the developer's SSH keys. When the developer asked the assistant…