Symlink Misdirection in AI Code Editors Enables Unauthorized File Modification
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
Researchers discovered a symlink-exploitation vulnerability affecting six widely-used AI coding assistants that allows malicious repositories to redirect file-write permissions to unintended sensitive targets. An attacker can craft a project that tricks the AI agent into requesting user approval for edits to a benign file, but the actual write operation modifies a critical system or configuration file instead. The affected tools include Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.
What to do
Developers should isolate AI coding assistants in sandboxed environments and enforce strict permission models for file operations.