GitSpawn漏洞評測：7款AI編程工具遭.git綁架 | GitSpawn Review: 7 AI Coding Agents Hit by Git Hijack

9月 10, 2026

By Kit 小克 | AI Tool Observer | 2026-09-11

🇹🇼 GitSpawn漏洞評測：7款AI編程工具遭.git綁架

如果你每天靠 Claude Code、Cursor、OpenAI Codex 這類 AI 編程代理寫程式，最近曝光的 GitSpawn 漏洞值得認真看一眼——安全公司 Manifold Security 在 9 月初一口氣揭露 7 款 AI 編程工具、共 8 個漏洞，攻擊者只要靠一個 Git 設定值，就能在你的電腦上跑任意指令，而且不會跳出任何確認視窗。

GitSpawn 是怎麼運作的？

問題出在 Git 一個叫 core.fsmonitor 的效能設定，這個值本來是拿來指定一支「檢查檔案有沒有變動」的程式，寫在 repo 自己的 .git/config 裡。只要有任何操作去刷新 index——包括最平常的 git status、git diff——Git 就會照著設定去執行那支程式。AI 編程代理為了知道現在在哪個分支、哪些檔案改過，背景會不斷跑這些指令，等於幫攻擊者按下了執行鍵。整個過程發生在代理的沙箱之外，以使用者權限執行，螢幕上什麼提示都不會出現。

哪些工具中鏢、修了沒？

已修復：goose（CVE-2026-72718，CVSS 7.0，1.44.0 版修掉）、Cursor、Claude Code 的第一條路徑（6/26 回報、6/29 的 2.1.196 版修復）
截稿仍未修復：Hermes Agent（CVE-2026-71963，廠商六次聯繫未回應）、Qwen Code、Grok Build，以及 Claude Code 的第二條設定路徑

什麼情況才會中招？

好消息是，一般用 git clone 抓下來的 repo 不會直接讓惡意設定生效；真正危險的是整個資料夾連 .git 一起搬過來的情境——壓縮檔分享、共用雲端硬碟、隨身碟、公司內部同步資料夾，這些都會把 .git/config 原封不動保留下來。如果你習慣把同事丟來的專案資料夾直接拖進 AI 編程工具開啟，GitSpawn 就是你該擔心的攻擊面。

開發者該做什麼

把 Claude Code、Cursor 等工具升到最新版，確認 changelog 有沒有提到 fsmonitor 或 git config 相關修復
不要用「整包資料夾複製」的方式接收不信任的專案，一律用 git clone 重新抓
打開任何來路不明的專案前，先看一眼 .git/config 裡有沒有奇怪的 core.fsmonitor 或 hook 設定
Hermes Agent、Qwen Code、Grok Build 使用者目前沒有官方修復，先手動避開上述風險情境

GitSpawn 再次證明 AI 編程代理的攻擊面不在模型本身，而在它跟系統互動的每一個「順手」動作。

好不好用，試了才知道。

🇺🇸 GitSpawn Review: 7 AI Coding Agents Hit by Git Hijack

If you rely on Claude Code, Cursor, or OpenAI Codex to write code every day, a vulnerability called GitSpawn is worth ten minutes of your attention. Security firm Manifold Security disclosed eight flaws across seven AI coding agents in early September, and the punchline is blunt: a single Git config value lets a malicious repository run arbitrary commands on your machine with zero approval prompt.

How GitSpawn Actually Works

The root cause is core.fsmonitor, a Git performance setting that names a program Git runs to detect changed files. That setting lives inside the repository's own .git/config. Any operation that refreshes the index — including plain git status or git diff — triggers Git to execute whatever core.fsmonitor points to. AI coding agents run those commands constantly in the background just to figure out which branch you're on and what changed, effectively pulling the trigger for the attacker. It happens outside the agent's sandbox, runs with full user privileges, and shows nothing on screen.

Who's Patched, Who Isn't

Fixed: goose (CVE-2026-72718, CVSS 7.0, patched in 1.44.0), Cursor, and Claude Code's first path (reported June 26, fixed in 2.1.196 on June 29)
Still open at publication: Hermes Agent (CVE-2026-71963 — vendor didn't respond to six outreach attempts), Qwen Code, Grok Build, and a second Claude Code config path

When You're Actually at Risk

A normal git clone won't hand an attacker this path directly. The real danger is when a folder's .git directory travels intact — zipped archives, shared cloud drives, USB sticks, or company sync folders all preserve .git/config as-is. If you're used to dragging a coworker's project folder straight into an AI coding tool instead of cloning it, GitSpawn is exactly the attack surface to worry about.

What Developers Should Do Now

Update Claude Code, Cursor, and similar tools, and check changelogs for fsmonitor or git-config fixes
Never accept untrusted projects as a "copy the whole folder" — always re-clone with git clone
Before opening any unfamiliar repo, check .git/config for unexpected core.fsmonitor or hook entries
Hermes Agent, Qwen Code, and Grok Build users have no official fix yet — avoid the risky scenarios above manually

GitSpawn is a reminder that the attack surface of AI coding agents isn't the model itself — it's every small, convenient action it takes while talking to your system.

My rule stays the same: you won't know if it's safe until you check it yourself.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士