GhostApproval let booby-trapped repos write to your SSH keys through Claude Code approvals: why it is not safe to use

What happened

Wiz disclosed an attack called GhostApproval on July 8, 2026. Reporting the next day said it affected six AI coding assistants, including Anthropic's Claude Code. The issue involved a symlink, which is a file that points somewhere else on your computer.

In the reported attack, a repository could contain a booby-trapped link so the agent asked for approval to edit a harmless-looking file such as `project_settings.json`. But the actual write could land on a sensitive file like `~/.ssh/authorized_keys` or `~/.zshrc` instead.

That matters because those files can help an attacker keep access to your machine or run commands later. Coverage said three of the six tools had shipped fixes, two had not, and Anthropic disputed that this was a bug at the time of publication.

What it means for you

If you use an AI coding agent, the approval prompt may not always tell the full story. A normal user could click approve for a routine project file and unintentionally allow a change to a security-sensitive file instead.

What to do instead

Treat approval prompts as a safety check, not a formality. Be extra cautious if a repo is new, untrusted, or copied from the internet. Avoid running agents with broad access to your home folder when possible. Watch for any request that could touch SSH keys, shell startup files, or other login settings. If you are unsure, inspect the repo first or use a more isolated environment.

AgentPod lists only reviewed, tested skills, which can help reduce surprise, but it is still wise to verify what an agent is being asked to change.

Sources:

• https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html