The Approval Prompt Was Never a Security Boundary

Six coding agents — Claude Code, Cursor, Amazon Q, Google Antigravity, Windsurf, Augment — all fell to the same class of bug this week. Wiz calls it GhostApproval. The agent shows you a path like ~/.bashrc and asks permission. You click yes. Symlink resolution runs after the click, and the real write target is a file the attacker controls through a crafted repo. The human-in-the-loop prompt confirmed the wrong object. Most vendors have no patch.

That is one of four disclosures in a single cycle. 0DIN's DNS-based injection ships a base64 reverse shell through a rotatable TXT record — the malicious repo contains zero malicious code, so static analysis and code review see nothing. HalluSquatting registers the package names LLMs reliably confabulate; npm install <hallucinated> is itself the compromise event, and lockfiles don't help because the bad name is what you typed. GitHub's own AI agent leaked private repositories after a prompt injection through a public issue. If GitHub can't hold the line on this, the line is in the wrong place.

The supporting numbers make the pattern worse. Unreviewed AI commits jumped from 10% to 40% of merges in one month. DigiCert's survey of 1,001 IT leaders puts the AI-incident rate at 78%, driven by misconfigured agents. Sophos found legitimate agents trip the same EDR rules as human intruders — enumerating files, reading env vars, spawning processes — which is what post-exploitation looks like, and also what an agent doing its job looks like. Attacker exfiltration compressed from 285 minutes to 72 in a year.

Yes, but — a fair reading is that these are early-vendor bugs a patch cycle closes. It's not. GhostApproval is patchable; HalluSquatting is a property of autoregressive generation, and DNS injection defeats the entire class of static controls. The confused-deputy problem — instructions and data sharing one channel — is architectural. Prompt hardening does not fix it.

The scaffolding this exposes

An AI agent's normal operation is indistinguishable from an attacker's. Your IAM was built for humans and static service accounts, and an agent is neither. The proposed six-stage non-human-identity maturity model concedes the industry is starting at zero. Amazon has already rejected human-in-the-loop approval outright, on the theory that approval fatigue is the vulnerability, and moved to three-layer automated scoping: static guardrails, per-agent maximum privilege, dynamic per-task policy. Google lands in the same place — fleets overseen, not approved. Both are right, and neither is what most enterprise deployments actually run.

Meanwhile the foundational-tooling floor is on fire. containerd CVE-2026-50195 (CVSS 9.9) executes code under another pod's identity through CRI checkpoint import — inheriting service accounts, network policies, and secrets, gated by nothing you configured. Fixed in 2.3.2/2.2.5/2.1.9; verify your managed-K8s provider actually rolled it. Five libcurl 9.8s, including an HTTP/2 use-after-free, link into your service mesh, CLI tools, CI runners, and container images. Two CVEs entered CISA KEV on July 7: Adobe ColdFusion CVE-2026-48282 at 10.0 and Joomla Page Builder CK, both actively exploited. BeyondTrust Remote Support and Citrix NetScaler each carry pre-auth RCE at 9.8+ — a compromised PAM appliance is a compromised environment, and a patch alone leaves the trust chain intact until the credentials it brokered are rotated.

And the AI/ML tooling itself ships trivial RCEs: IBM Langflow (seven CVEs up to 10.0), Crawl4AI at 10.0, LLaMA-Factory at 9.8 via a malicious model path, Feast's /save-document at 9.1 for unauthenticated writes to your feature store. LLaMA-Factory is the tell — the model artifact is now a code-execution surface. Your supply-chain threat model has to extend past Python deps into the weights.

What actually changed

The review gate collapsed in thirty days because the models crossed the threshold where developers rationally stopped checking. That is not laziness a memo fixes. It is individually rational behavior compounding into systemic risk, and it happened to intersect with the week the exploit classes got names.

The implication is not "slow down." It's that every quality gate, security scan, and IAM control you own was designed for human-authored code reviewed by humans and privileged identities that persist for weeks. That world ended last month. Approval-based oversight fails in both directions at machine speed: attacks land faster than humans triage, and agents act faster than humans review.

Do this week

One owner, one week, three moves. First, inventory every AI agent with privileged access to code, data, or production — sandbox configuration, repository trust, prompt-injection exposure, credentials held. You cannot govern what you have not enumerated, and "we use Cursor" is not an inventory. Second, move untrusted-repo agent work into disposable containers or Firecracker microVMs with no network egress except a controlled proxy and no host credentials. That is the only durable defense against GhostApproval and the DNS-payload class; prompt controls demonstrably fail. Third, add a CI provenance gate that blocks any AI-added dependency created in the last thirty days or lacking maintainer history, and pin by hash. HalluSquatting dies at install-time or not at all.

The metric to instrument alongside all of this: percentage of merged commits authored by an agent with no human diff review. If you cannot answer it today, that is the first number to build. It is now the leading indicator for every incident this stack is about to produce.