Symlink Vulnerability Affects Six AI Code Agents, Including Amazon Q and Cursor

Specialists at Wiz discovered an old Unix technique using symbolic links (symlink) that allows bypassing built-in security mechanisms in six popular AI code agents, from Amazon Q to Cursor.

How the attack works

The exploit idea is simple yet insidious: an attacker prepares a repository with a malicious symbolic link in advance and makes it publicly available. When an AI agent opens such a repository and starts working with files, the symlink masks a dangerous path as an ordinary project file. As a result, the agent literally "walks past" its own security prompt — the very mechanism designed to stop the execution of suspicious or potentially dangerous commands.

The outcome of the attack is that the attacker gains the ability to place an access key in the repository that opens the attacker to the developer's work machine. The tool that the developer trusted with autonomous code work becomes a point of entry for compromise.

Which tools are at risk

Wiz researchers indicate that the vulnerabilities affect at least six popular AI code agents. Amazon Q from Amazon and Cursor are named in the material — both are widely used by developers for autonomous code writing, review, and editing. It is noteworthy that the breach exploits not a new attack technique, but a mechanism of symbolic links known for decades in Unix systems — only now it strikes a completely new class of tools to which developers delegate real command execution rights.

The symlink mechanism has itself been considered a known source of security problems in Unix-like systems for decades, but it is the widespread adoption of autonomous AI agents that independently read and execute repository contents that has given this old technique new practical danger.

• Wiz company discovered the vulnerability, specializing in cloud cybersecurity
• A classic Unix technique with symbolic links (symlink) was used
• Vulnerability confirmed in at least six AI code agents, including Amazon Q and Cursor
• Result of the attack — an access key that opens the attacker to the developer's machine

What this means

The symlink story shows that the autonomy of AI agents trusted with code and file system work creates a new attack surface: old bugs in basic system mechanisms suddenly become truly dangerous because they are now handled not by a cautious human but by an agent with broad command execution rights and minimal context to suspect a trick. For teams that have already connected AI agents to real repositories and production machines, this is a reason to reconsider what rights the agent has by default and how files are checked before the agent starts working with them. Wiz's discovery also reminds us that AI agent security prompts and built-in restrictions are not an absolute barrier but only one level of protection that can be bypassed by quite classical technical techniques that have no direct relation to the model itself.

Frequently asked questions

Which AI code agents turned out to be vulnerable?

Wiz names at least six popular tools for code writing with AI; Amazon Q and Cursor are mentioned by name in the material — both are used by developers for autonomous work with repositories.

What does an attacker get as a result of the attack?

An access key that opens the attacker to the developer's work machine: an infected repository becomes a way to compromise the environment of whoever opened it via the vulnerable AI agent.

Why is this attack considered particularly dangerous?

Because it exploits not a vulnerability in a specific model but a classic and long-known Unix technique with symbolic links — which means it could potentially apply to any AI agent that autonomously reads and executes repository contents without strict checking of such paths.