English(EN) Wiz disclosed GhostApproval: a symlink flaw in 6 AI coding assistants. A malicious repo can hijack the human-in-the-loop confirmation dialog to write to ~/.ssh/

AI编码助手易受恶意代码库劫持攻击

作者 PulseAugur 编辑部 · [1 个来源] · 2026-07-08 16:08

Wiz发现了一个名为GhostApproval的关键安全漏洞，影响了六款AI编码助手。该漏洞允许恶意代码库劫持人工审核确认对话框，从而能够未经授权地写入敏感文件，例如"~/.ssh/authorized_keys"。虽然AWS、Cursor和Google已为其各自的助手发布了补丁，但Anthropic、Augment和Windsurf尚未解决此漏洞。 AI

影响此漏洞可能允许恶意代码注入开发工作流程，从而可能危及敏感凭证和系统。

排序理由披露影响AI开发工具的安全漏洞。

在 Mastodon — fosstodon.org 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

报道来源 [1]

Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] · 2026-07-08 16:08

Wiz disclosed GhostApproval: a symlink flaw in 6 AI coding assistants. A malicious repo can hijack the human-in-the-loop confirmation dialog to write to ~/.ssh/

Wiz disclosed GhostApproval: a symlink flaw in 6 AI coding assistants. A malicious repo can hijack the human-in-the-loop confirmation dialog to write to ~/.ssh/authorized_keys. AWS, Cursor, and Google patched; Anthropic, Augment, Windsurf have not. https:// go.aintelligencehub.co…

链接 aintelligencehub.com/link-not-found aintelligencehub.com/link-not-found

报道来源 [1]

Wiz disclosed GhostApproval: a symlink flaw in 6 AI coding assistants. A malicious repo can hijack the human-in-the-loop confirmation dialog to write to ~/.ssh/

相关实体

相关话题