MEDIUMVulnerability
Global
AI Coding Tools Can Fake Approval Prompts
·Source: Bank Info Security
Updated:
Executive Summary
Old Unix Symlink Trick Lets Malicious Code Bypass User Checks Wiz researchers found that six popular AI coding assistants can be tricked into modifying sensitive files, including SSH keys, while their approval prompts display a harm
Analysis
Old Unix Symlink Trick Lets Malicious Code Bypass User Checks Wiz researchers found that six popular AI coding assistants can be tricked into modifying sensitive files, including SSH keys, while their approval prompts display a harmless filename. The GhostApproval technique exploits a decades-old Unix symlink behavior to mislead users.