GhostApproval: AI Coding Assistants Tricked via Symlink Into Hacking Developer Machines
Researchers demonstrated that AI coding assistants can be exploited using a decades-old symlink technique — dubbed "GhostApproval" — to modify files outside the intended project scope and potentially compromise the developer's machine.
What Happened
GhostApproval abuses a classic time-of-check/time-of-use symlink weakness: a file the agent believes is a harmless, in-scope project file is actually a symbolic link pointing somewhere else entirely — a config file, a credentials store, or another user's data. When the agent (or the human reviewing its diff) approves what looks like a routine, in-scope edit, the write actually lands on the symlink target. The technique itself predates AI coding agents by decades, but agents reintroduce it at scale: they read, edit, and "approve" far more files per session than a human ever would, and they don't reliably distinguish a real file from a symlink pointing outside the sandbox before writing to it.
Why This Matters for Thuban
GhostApproval matters less because it's novel and more because it's old. It's a reminder that:
- AI coding agents inherit every classic filesystem vulnerability class, not just novel LLM-specific ones.
- Approval UIs that show "what looks like a safe, scoped edit" can be trivially deceived by symlink indirection.
- The volume and speed at which agents operate makes manual, per-file symlink-awareness an unrealistic mitigation for humans in the loop.
- Sandbox boundaries need to be enforced at the filesystem layer, independent of what the agent (or its UI) believes it's writing to.
File Guard
Resolves symlink targets before a write is permitted, rather than trusting the path the agent believes it's editing.
Shadow Realm
Every proposed write is evaluated in isolation before it touches disk — including where it would actually land.
Watchers
Real-time monitoring flags directory traversal and out-of-scope target resolution the moment it happens.
Audit & Recovery
Automatic pre-write snapshots and instant rollback if a symlink-indirected write does slip through.
Positioning
Old exploit techniques don't disappear when the tooling gets smarter — they just get a new, faster delivery mechanism. Independent runtime enforcement has to assume the agent's own view of "in scope" can't be trusted.
Product Implication
GhostApproval is a useful counterweight to the more exotic sandbox-escape stories in the news cycle: it shows that Thuban's defence-in-depth approach — resolving real filesystem targets independently of what an agent or its UI claims — matters just as much for well-understood, decades-old techniques as it does for novel prompt-injection chains. Shield's File Guard and Shadow Realm layers are designed precisely to catch this class of indirection before a write lands somewhere unintended.
Sources
Does your agent know a symlink when it sees one?
Free, no signup, runs entirely locally — your code never leaves your machine.
npx thuban protectIndependent runtime monitoring and enforcement for Claude Code, Codex, Cursor, Gemini CLI — any AI coding agent.