【四大AI编程代理曝相同安全漏洞,“技能”更新机制遭劫持风险】网络安全初创公司Air独家披露,Anthropic Claude Code、OpenAI Codex、Google Gemini CLI及GitHub Copilot四款主流AI编程代理存在相同逻辑缺陷:其“技能”自动更新机制未校验内容变更,攻击者可伪装同名恶意更新绕过扫描,静默窃取企业代码或知识产权。该漏洞源于各厂商验证机制设计雷同,凸显行业共性盲区。目前除GitHub外其余三家已修复;GitHub称平台机制可阻断此类攻击,但未确认补丁状态。
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.