When the Approval Button Lies

For the past year, the standard safety answer for AI agents has been comforting and simple: let the robot draft, but a human approves before anything irreversible happens. Sign here. Click to confirm. The human in the loop is the backstop.

This week, security researchers at Wiz showed that the backstop has a crack in it. They disclosed a vulnerability pattern called GhostApproval, and it does not attack the model, the network, or the server. It attacks the approval prompt itself, the exact moment you were told to trust.

What actually happened

According to Wiz, GhostApproval let a malicious repository trick six major AI coding assistants into accessing or modifying files outside their intended workspace. The affected list is not a lineup of hobby projects. It includes Amazon Q Developer, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf.

Here is the part that should make you sit up. In some cases, the agent internally recognized that the target was dangerous, and then showed the user an approval prompt that obscured that risk. The tool knew. The prompt did not say so. You would have clicked yes.

The agent knew it was dangerous, and the prompt you would have approved did not tell you.

Think of it like a contractor who hands you a one-page summary to sign. The summary says minor kitchen touch-up. The actual work order, stapled underneath where you cannot see it, says knock down the load-bearing wall. You are not careless. You read the page you were given. The page just lied.

This was not a one-off

GhostApproval is the headline, but it landed inside a brutal stretch. As reported by The Next Web, four independent teams shipped working exploits against production AI agents in roughly ten days. The variety is the scary part, because it means this is not one bug, it is a category:

• AWS Kiro: hidden one-pixel text on a page was enough to make the agent rewrite its own configuration file (mcp.json) and automatically launch an attacker-controlled server.
• Cursor: two separate zero-click remote code execution flaws, each rated CVSS 9.8, which is about as severe as the scoring scale goes.
• Cursor, again: a deeplink flaw that turned an innocent-sounding request to review a pull request into unsandboxed code execution.
• Claude for Chrome: Manifold Security showed that any installed browser extension could hijack the agent to read Gmail, Docs, and Calendar by spoofing your clicks.

The common thread, the reason The Next Web framed it as four attacks and one flaw, is that all of these agents treat content they read (a repo, a web page, a browser extension) as if it might be instructions. That is prompt injection wearing four different costumes. Someone is even keeping a dated, sourced community timeline of these incidents on GitHub now, which tells you the field has moved from thought experiment to logbook.

Why this matters beyond the security team

Most agent safety advice quietly assumes one thing is solid: that when a human is asked to approve an action, the human can actually see what they are approving. GhostApproval breaks that assumption. If the prompt can misrepresent the action, then human approves before irreversible actions is no longer a complete control on its own. It is only as good as the honesty of the screen.

That changes the checklist. It is not enough to ask is there a human in the loop. The new questions are sharper:

• What exactly does the approval prompt display?
• Is the displayed target verified against the real action, the actual file path, recipient, or amount?
• Is the approving click confirmed as a genuine human gesture, not a spoofed one (the Manifold finding)?

The integrity of the approval surface becomes its own thing you have to check, right alongside the action itself.

The one-sentence defense

If you take nothing else from this, take the rule the researchers keep circling back to: anything an agent reads is potential instructions. A repo. A web page. A pull request. A browser extension sitting quietly beside it. Once you accept that, the mitigation is less about clever detection and more about limits: scope tightly what the agent is allowed to touch, so that even a successful trick has a small blast radius.

There is a cheap, boring, useful move hiding in the Claude for Chrome finding too. If you run browser-based agents or coding assistants, take thirty minutes and audit what browser extensions are installed and what they are permitted to listen to. It is not glamorous. Neither is a smoke detector.

The uncomfortable takeaway

We spent a year building governance around a friendly picture: the agent proposes, the human disposes. GhostApproval does not tear that picture down. It just points at the one pixel we never inspected. The lesson is not to stop using agents. It is that a trustworthy-looking surface is only as trustworthy as the verification sitting behind it. The button that says yes has to be telling the truth, and now we have to prove that it is.