Symlink flaw hits six AI coding agents, including Amazon Q and Cursor

Researchers at Wiz have discovered an old Unix trick involving symbolic links (symlinks) that bypasses the built-in safeguards of six popular AI coding agents at once, from Amazon Q to Cursor.

How the attack works

The exploit is simple but insidious. An attacker prepares a repository containing a malicious symlink in advance and publishes it openly. When an AI agent opens the repository and starts working with its files, the symlink disguises a dangerous path as an ordinary project file. The agent then effectively walks right past its own safety prompt — the very mechanism meant to stop suspicious or potentially dangerous commands from running.

The payoff: the attacker can plant an access key in the repository that opens the developer's workstation to them. The tool a developer trusted to work on code autonomously becomes the entry point for a compromise.

Which tools are at risk

Wiz researchers say at least six popular AI coding agents are vulnerable. The report names two of them: Amazon's Amazon Q and Cursor, both widely used by developers to write, review, and edit code autonomously. Notably, the flaw doesn't rely on a new attack technique. It exploits symbolic links, a mechanism Unix systems have had for decades — except now it targets an entirely new class of tools to which developers hand real command-execution privileges. Symlinks have long been a known source of security problems on Unix-like systems, but the spread of autonomous AI agents that read and execute repository contents on their own has given this old trick new practical danger.

• The vulnerability was discovered by Wiz, a cloud cybersecurity company
• The attack uses a classic Unix symbolic link (symlink) trick
• At least six AI coding agents are confirmed vulnerable, including Amazon Q and Cursor
• The result of the attack is an access key that opens the developer's machine to the attacker

What it means

The symlink case shows that the autonomy of AI agents entrusted with code and the file system creates a new attack surface. Old bugs in basic system mechanisms suddenly become genuinely dangerous, because they are no longer handled by a cautious human but by an agent with broad command-execution rights and minimal context to sense that something is off. Teams that have already connected AI agents to real repositories and production machines should take this as a reason to review what permissions their agents have by default and how files are checked before an agent starts working with them.

Wiz's finding is also a reminder that safety prompts and built-in restrictions in AI agents are not an absolute barrier. They are just one layer of defense, and one that can be bypassed with entirely conventional techniques that have nothing directly to do with the model itself.

Frequently asked questions

Which AI coding agents were vulnerable?

Wiz points to at least six popular AI coding tools; the report names Amazon Q and Cursor, both of which developers use to work with repositories autonomously.

What does the attacker gain from the attack?

An access key that opens the developer's workstation to the attacker: the infected repository becomes a way to compromise the environment of anyone who opens it through a vulnerable AI agent.

Why is this attack considered especially dangerous?

Because it doesn't exploit a weakness in any particular model. Instead, it relies on a classic, long-known Unix symlink trick — which means it could potentially work against any AI agent that autonomously reads and executes repository contents without strictly checking these kinds of paths.