GitSpawn漏洞評測：開資料夾就中招，7款AI編碼代理躺槍 | GitSpawn Vulnerability Review: 7 AI Coding Agents, Zero Clicks

By Kit 小克 | AI Tool Observer | 2026-09-04

🇹🇼 GitSpawn漏洞評測：開資料夾就中招，7款AI編碼代理躺槍

GitSpawn是資安公司Manifold Security本週揭露的一類新漏洞，影響Claude Code、Cursor、Codex、Grok Build、goose、Qwen Code、Hermes Agent等七款主流CLI型AI編碼代理。最可怕的地方不是「駭客又找到漏洞」，而是攻擊完全零點擊——你只要用AI代理打開一個惡意repo資料夾，代理背景執行git status之類的例行指令時就會中招，不用貼prompt、不用按確認鍵，甚至有情況是使用者都還沒登入代理就已經執行了攻擊者的指令。

GitSpawn漏洞原理：git設定檔藏後門

幾乎所有AI編碼代理在開啟專案時都會安靜地跑一串git指令來抓上下文，例如git status、git diff。Git本身有個效能設定叫core.fsmonitor，可以在repo設定裡指定一支「helper程式」，每次git索引刷新時自動執行。攻擊者只要把惡意指令埋進這個設定欄位，等AI代理跑那些看似無害的git指令時，惡意程式就會以登入使用者的完整權限執行——完全繞過代理自己的沙盒與權限確認機制，而且對使用者完全不可見。

受影響範圍與修補進度

已修補：goose、Claude Code（部分路徑）、Cursor
9月1日retest時仍未修補：Hermes Agent、Qwen Code、Grok Build，以及Claude Code的第二條攻擊路徑
總計揭露8個漏洞、橫跨7款代理

為什麼GitSpawn比一般AI資安漏洞更值得注意

過去講AI代理資安問題,多半圍繞「prompt injection」——需要誘導模型輸出惡意指令,理論上還有防線可擋。GitSpawn完全不需要模型「被騙」,它利用的是代理呼叫底層git工具鏈時的設計盲區:代理開發者假設git指令本身是安全的,卻沒想到repo自己的設定檔就能挾持整條指令鏈。這代表光靠模型層的安全對齊或prompt filter完全無效,問題出在工具呼叫的執行層。

開發者該怎麼做

立刻檢查手邊使用的AI編碼代理是否在受影響清單,並確認版本已修補
對於未修補的Hermes Agent、Qwen Code、Grok Build,避免用它們直接打開不信任來源的repo(GitHub上fork的陌生專案、面試考題repo、CTF題目等)
企業內部若有CI/CD會自動用AI代理處理外部PR,建議先隔離沙盒環境測試
定期檢查.git/config裡是否有異常的core.fsmonitor或hook設定

GitSpawn再次證明,2026年AI編碼代理的資安戰場已經從「模型會不會被騙」轉移到「代理背後呼叫的工具鏈夠不夠乾淨」。工具越自動化、背景指令越多,攻擊面就越大。

好不好用,試了才知道。

🇺🇸 GitSpawn Vulnerability Review: 7 AI Coding Agents, Zero Clicks

GitSpawn is a newly disclosed vulnerability class from security firm Manifold Security, hitting seven mainstream CLI-based AI coding agents: Claude Code, Cursor, Codex, Grok Build, goose, Qwen Code, and Hermes Agent. The scary part isn't that researchers found another bug — it's that the attack is entirely zero-click. Just open a booby-trapped repository folder with an AI coding agent, and the moment the agent silently runs a routine git command like git status in the background, you're compromised. No prompt typed, no approval clicked, and in some cases the code executes before the user has even authenticated.

How the GitSpawn Vulnerability Works

Nearly every AI coding agent gathers project context on startup by quietly running git commands. Git has a performance setting called core.fsmonitor, which lets a repository's own config specify a helper program that git runs automatically whenever the index refreshes. An attacker simply embeds an arbitrary command in that config field. The moment an AI agent runs a routine context-gathering git command inside the malicious repo, that command executes with the full privileges of the logged-in user — completely outside the agent's sandbox and invisible to any permission system.

Affected Agents and Patch Status

Patched: goose, Claude Code (partial), Cursor
Still unpatched as of Sept 1 retest: Hermes Agent, Qwen Code, Grok Build, and a second attack path in Claude Code
Total disclosed: 8 flaws across 7 agents

Why GitSpawn Matters More Than Typical AI Security Bugs

Most AI agent security discussions center on prompt injection — tricking the model into outputting malicious instructions, which at least has theoretical defenses. GitSpawn requires no model deception at all. It exploits a blind spot in how agents call the underlying git toolchain: developers assumed git commands themselves were safe, never anticipating that a repo's own config file could hijack the entire command chain. Model-level alignment and prompt filters are completely irrelevant here — the flaw lives in the tool-execution layer, not the model layer.

What Developers Should Do Now

Check immediately whether your AI coding agent is on the affected list and confirm the patched version is installed
For unpatched agents (Hermes Agent, Qwen Code, Grok Build), avoid opening untrusted repos — random GitHub forks, take-home interview repos, CTF challenges
If your CI/CD pipeline lets an AI agent auto-process external PRs, isolate that in a sandbox first
Periodically audit .git/config for suspicious core.fsmonitor or hook entries

GitSpawn is another sign that AI coding agent security in 2026 has shifted from "can the model be tricked" to "is the tool chain behind the agent actually clean." The more automated the tooling and the more background commands it fires, the bigger the attack surface.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士