GhostApproval and JadePuffer: The Approval Prompt Is Not a Control

Two security disclosures arrived this week within days of each other. Neither is speculative. Both involve verified behavior from real tools in production. Together, they close the argument about whether a confirmation dialog constitutes governance over an AI coding agent. It does not.

What GhostApproval Is and Why the Name Is Accurate#

Wiz Research published GhostApproval on July 8, disclosing a symlink-based trust boundary flaw in six AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack primitive is CWE-61, symlink following, which dates back decades. The attack in practice is simple: a malicious repository ships a file named project_settings.json that is actually a symbolic link to ~/.ssh/authorized_keys. The agent is instructed to write a value to that file. It does. The user's SSH authorized keys now contain an attacker's public key.

The confirmation dialog , the thing marketed as the human-in-the-loop safety net , showed project_settings.json. Not ~/.ssh/authorized_keys. The agent's internal reasoning, in at least one tested case involving Claude Code, explicitly stated it recognized the symlink target. That recognition did not surface in the approval prompt. CWE-451: UI misrepresentation of critical information, stacked on top of CWE-61.

Windsurf's behavior was worse: the write happened before the Accept/Reject buttons appeared. By the time the dialog rendered, the attacker's key was already in authorized_keys. The dialog was an undo button, not an authorization gate.

AWS (CVE-2026-12958), Cursor (CVE-2026-50549), and Google patched. Augment and Windsurf acknowledged receipt as of July 8 but had not shipped fixes. Anthropic initially rejected the report as outside its threat model. According to Wiz, current Claude Code versions now resolve symlinks and warn before writing to sensitive files; Anthropic states this hardening shipped in v2.1.32 on February 5, 2026, as proactive security work, and declined to comment on whether it was related to the report.

What JadePuffer Did in 31 Seconds#

Sysdig's Threat Research Team published JadePuffer on July 1, documenting what the team assesses as the first end-to-end agentic ransomware operation. An LLM agent exploited CVE-2025-3248, a missing-authentication flaw in an internet-facing LangFlow instance, gained code execution, and ran a complete intrusion without a human directing the technical phases.

The sequence matters. The agent enumerated the host, swept environment variables for LLM provider keys, AWS credentials, and cryptocurrency seed phrases, dumped LangFlow's backing Postgres database, probed internal services using default credentials, and pivoted to a separate production server running MySQL and Alibaba Nacos. On that server, it encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropped the original tables, and wrote a ransom note to a new table named README_RANSOM containing a Bitcoin address and a Proton Mail contact.

The most precise evidence of autonomy came mid-operation. At 19:34:36 UTC, a login attempt with the newly created xadmin account failed. At 19:35:07 , 31 seconds later , the agent issued a corrective payload that diagnosed the root cause as a subprocess PATH issue, deleted the broken account, switched from subprocess.run() to a direct import bcrypt, and reinserted the user with a correctly generated hash. At 19:35:18, the login succeeded. A human operator reading an error, tracing the cause to a PATH issue, drafting a fix, and resubmitting takes considerably longer than 31 seconds.

The AES key used for encryption was generated as base64(uuid4().bytes + uuid4().bytes), printed once to stdout, and never stored or transmitted. The victim cannot recover the configurations even with payment.

The Consent Theater Problem#

GhostApproval and JadePuffer describe different attack surfaces, but they expose the same architectural failure. Both depend on the assumption that showing a user a description of an action is equivalent to governing that action.

It is not. The GhostApproval dialog showed a filename. The agent wrote to a different file. Formal consent was present; meaningful consent was absent. JadePuffer required no consent at all , it operated against infrastructure where no human approval step existed in the attack chain. The agent adapted, corrected, and persisted entirely on its own terms.

Anthropic's initial response to Wiz articulated a coherent position: the user trusted the directory, the user approved the prompt, so the responsibility falls to the user. That argument holds only if the prompt contains accurate information. When it displays project_settings.json while writing to ~/.ssh/authorized_keys, the logical foundation of the argument collapses. Consent requires knowing what you are consenting to.

Why the Independent Review Layer Is the Only Layer That Holds#

The vendor with a gap in this week's disclosures is not one vendor , it is the entire category of in-band controls. A control that the agent mediates can be subverted by the agent, whether through deliberate deception (GhostApproval) or by simply not existing at the right moment (JadePuffer's infrastructure pivot).

The argument for out-of-band review is not theoretical. An independent reviewer operating in a separate environment, reading what the agent actually wrote to disk rather than what the agent claimed it intended to write, cannot be bypassed by a symlink in a confirmation prompt. It sees the resolved path. It sees the diff. It checks the output against the six domains where problems surface: security, code quality, reliability, API and data, ops, UX.

Hyrax runs that review in an isolated worktree, runs a battery of verification checks against the actual artifact, and submits a PR. The user merges. The agent cannot short-circuit that process because the process does not run inside the agent's context.

What the Pattern Looks Like Going Forward#

JadePuffer's self-narrating payloads are the most instructive detail in the Sysdig report. The decoded Python included natural-language commentary explaining target prioritization, rationale for each step, and labels like "High-ROI databases to drop." Human operators writing disposable python3 -c one-liners do not annotate them. LLM code generation does so by default, which is precisely how the Sysdig team identified the agent's fingerprint.

That fingerprint will improve. The annotations will get stripped. The correction speed will stay at machine speed. The 31-second fix cycle that distinguished JadePuffer from a human operator in July 2026 will be unremarkable by mid-2027. The detection signal will degrade; the capability will not.

The supply-chain dimension is adjacent: as covered in the hallucinated dependency attack, AI coding agents introduce attack surfaces that did not exist when humans wrote every line. GhostApproval is another instance of the same pattern , agents executing instructions from repositories they were told to trust, without sufficient verification of what those instructions actually do.

The structural answer is the same in both cases. The agent should not be the last reviewer of its own work.

Hyrax is live at hyrax.dev.