GitSpawn漏洞評測：Git設定檔讓7款AI寫碼工具中招 | GitSpawn Review: Git Configs Hijack AI Coding Agents

By Kit 小克 | AI Tool Observer | 2026-09-07

🇹🇼 GitSpawn漏洞評測：Git設定檔讓7款AI寫碼工具中招

GitSpawn 是資安公司 Manifold Security 在 2026 年 9 月揭露的漏洞：打開一個帶惡意 .git/config 的資料夾，Claude Code、Cursor、Codex、Grok Build 等主流 AI 寫碼工具就可能背著使用者執行攻擊者指定的程式碼。這不是模型講錯話那種問題，而是最底層 Git 指令被動了手腳，殺傷力更直接。

GitSpawn 是什麼？一個 core.fsmonitor 設定就中鏢

問題出在 Git 的效能設定 core.fsmonitor，本意是讓大型專案指定「輔助程式」在索引更新時被呼叫。AI 寫碼工具開場就會自動跑 git status、git diff 之類背景指令搞清楚專案狀態，卻原封不動吃進 repo 自帶的設定檔。攻擊者只要把惡意指令塞進 core.fsmonitor 欄位，agent 一開工指令就以使用者權限跑掉，而且發生在任何「信任此資料夾」確認視窗跳出來之前，沒有沙箱、沒有審批。

哪些 AI 寫碼工具中招？修補進度一次看

已修補：Claude Code（2.1.196）、Cursor、OpenAI Codex（0.131.0 起）、goose（1.44.0，編號 CVE-2026-72718，CVSS 7.0）
9 月 1 日仍未修補：Hermes Agent（CVE-2026-71963，CVSS 8.6）、Qwen Code、Grok Build，以及 Claude Code 另一條 ultrareview 指令路徑的第二個漏洞

Hermes Agent 的 CVE 是 Manifold 聯繫廠商六次沒回應後自行申請公開的，供應鏈資安通報流程堪憂。

攻擊怎麼發生？不用 clone，開資料夾就中

攻擊者把整包專案（含 .git）包成 zip，放上共用雲端硬碟或隨身碟散布，不需誘騙受害者用 git clone。使用者只要用 AI 寫碼工具打開資料夾，agent 為理解專案而自動跑的 Git 背景指令就會觸發惡意設定，攻擊者可藉此拿到 SSH 金鑰、雲端憑證。

開發者現在該做什麼

立刻把 Claude Code、Cursor、Codex、goose 升級到已修補版本
不要用 AI agent 直接打開來路不明的 zip 專案或隨身碟程式碼
Hermes Agent、Qwen Code、Grok Build 使用者先自行在 shell alias 加上 git -c core.fsmonitor=false 降低風險
持續關注廠商公告，Anthropic 目前對兩個 Claude Code 漏洞都還沒發正式安全公告

GitSpawn 再次證明：AI agent 的資安破口往往不在模型本身，而在它呼叫的那些「看起來很無害」的底層工具鏈。用 AI 寫碼工具加速開發沒問題，打開不熟悉的專案前多一分戒心不吃虧。好不好用，試了才知道。

🇺🇸 GitSpawn Review: Git Configs Hijack AI Coding Agents

GitSpawn is a vulnerability class disclosed by security firm Manifold Security in September 2026: simply opening a folder containing a malicious .git/config can let popular AI coding agents — including Claude Code, Cursor, Codex, and Grok Build — execute attacker-controlled code without the user ever approving anything. This isn't a "the model said something bad" kind of AI safety issue; it's the underlying Git plumbing itself being weaponized, which makes it far more dangerous.

How GitSpawn Works: One core.fsmonitor Setting Is Enough

The root cause is core.fsmonitor, a Git performance setting originally meant to let large repositories point at a helper program that runs during index refreshes. To figure out "what project am I in, what's the branch state," AI coding agents automatically run background commands like git status and git diff the moment they open a folder — and those calls pass the repo's own config through untouched. An attacker just needs to plant a malicious command in the core.fsmonitor field of .git/config. The moment the agent starts working, that command runs with the user's full privileges — outside any sandbox, before any "trust this folder" prompt ever appears.

Which Agents Are Affected? Patch Status So Far

Patched: Claude Code (fixed in 2.1.196 for the core.fsmonitor path), Cursor, OpenAI Codex (fixed from 0.131.0), goose (fixed in 1.44.0, tracked as CVE-2026-72718, CVSS 7.0)
Still unpatched as of September 1: Hermes Agent (CVE-2026-71963, CVSS 8.6), Qwen Code, Grok Build, plus a second Claude Code flaw via the ultrareview command path

Notably, the Hermes Agent CVE was self-published by Manifold after six failed attempts to reach the vendor — not a great sign for how the AI tooling supply chain handles security disclosures.

The Attack: Just Opening a Folder Is Enough

The exploit doesn't even require a git clone. An attacker packages a full project — .git directory included — as a zip file and distributes it via shared drives or USB sticks. As soon as a victim opens that folder with an AI coding agent, the background Git commands the agent runs to gather context trigger the malicious config, potentially handing over SSH keys and cloud credentials.

What Developers Should Do Right Now

Update Claude Code, Cursor, Codex, and goose to the patched versions listed above immediately
Don't open zip archives or USB-sourced code with an AI agent unless you trust the source
Hermes Agent, Qwen Code, and Grok Build users should manually disable fsmonitor via a shell alias like git -c core.fsmonitor=false until an official fix ships
Watch for vendor advisories — Anthropic has not yet published formal security bulletins for either Claude Code finding

GitSpawn is a reminder that the biggest security gap in AI agents often isn't the model — it's the seemingly harmless tool chain underneath it. AI coding agents are still great productivity tools, but think twice before opening an unfamiliar project. As always: it's only good if it actually works for you — try it yourself.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士