Malicious repo symlink could make Claude Code write to your SSH keys: why it is not safe to use

What happened

Wiz Research disclosed a technique called GhostApproval on July 9, 2026. It affected five AI coding agents: Claude Code, Amazon Q, Cursor, Google Antigravity, and Windsurf. The issue used a symlink, which is a file that points to another file somewhere else on the computer.

In practice, a repository could contain a project file that looked safe in the approval prompt, but actually pointed to a sensitive file such as `~/.ssh/authorized_keys` or a shell startup file. That means an agent could ask to write to what looks like a normal project file, while the real write would land in a security-sensitive location.

Permission Protocol’s incident page says Amazon and Cursor patched this on July 9, 2026. It also says Anthropic declined to patch Claude Code, saying users explicitly trust project directories.

What it means for you

For a normal person, the main risk is simple: if you open the wrong repository and approve a write, you could help install a persistent backdoor, which is a hidden way for someone to keep access to your computer.

This does not mean every repo is dangerous. It means approval screens may not always tell the full story if a repo contains misleading file links.

What to do instead

Use AI coding agents only with repositories you trust. Be extra careful with repos from strangers, demos, or one-click examples.

Avoid approving writes unless you understand why they are needed. If a tool wants to edit keys, shell profiles, or login-related files, stop and check.

Keep your coding agent, editor, and OS up to date, and prefer tools that clearly show the real file path before a write.

AgentPod lists only reviewed, tested skills, which can help reduce surprise behavior, but it is still worth checking what any tool is about to change.

Sources:

• https://www.wiz.io
• https://www.permissionprotocol.com/agent-incident-tracker/ghostapproval-wiz-symlink-hitl-bypass-july2026