Why it matters
SymJack demonstrates that a user-approved, apparently harmless copy command can write through a repository-controlled symlink into executable agent configuration, producing code execution when the tool restarts. The vendor-authored study reports variants across six coding agents and highlights a gap between approval text, shell semantics, and the resolved filesystem target.
My takeaway: Before approval and execution, resolve symlinks and canonicalize every destination, then apply the same write policy to shell commands as native file tools. Block project content from modifying agent or MCP configuration, scan cloned repositories for links, and isolate unattended CI agents from credentials and production networks.