The approval dialog lied about the path

Wiz published GhostApproval in July 2026: a workspace file that is really a symlink. The agent is asked to write a harmless local config; the kernel follows the link and the write lands on ~/.ssh/authorized_keys or ~/.zshrc. The primitive is CWE-61. The worse layer is CWE-451 — several assistants already knew the resolved target in their own reasoning, then showed the decoy path in the approval box. You clicked Accept on project_settings.json. The disk change was not that file.

That is an operator note for anyone building agent sandboxes, not a new gem. Informed consent needs the real destination. Resolve the symlink, show the canonical path, and refuse (or flag) writes that leave the workspace. A human-in-the-loop that only displays the name the repo invented is not a loop — it is a costume. The sandbox that checks the requested path and not the resolved one is another paper wall.