研究：CLAUDE.md 等记忆文件可成为编码智能体的攻击面
Security Impact of Coding Agent's Memory Files
如果你平时用 Claude Code 或 OpenCode 写代码，这篇值得花十分钟：一次 PR 改个 CLAUDE.md 就可能让你的智能体悄悄写出有漏洞的代码。
arXiv 论文测试了恶意项目记忆文件（如 CLAUDE.md）能否诱导编码智能体生成有漏洞的代码。研究针对 12 类 CWE 设计了两种恶意文件，在 36 个 SecRepoBench 任务上运行 Claude Code（Sonnet 5.5）和 OpenCode（Qwen 3.8 27B、DeepSeek V4.1 Flash）。结果显示恶意文件使安全完成率变化在 -8 到 +6 个百分点之间，不同智能体之间没有一致规律。透明度差异明显：Claude Code 约三分之二的最终消息会提及该文件，OpenCode 几乎只在推理轨迹中提及。即使将文件标记为攻击，智能体仍可能生成带漏洞的代码。
Security Impact of Coding Agent's Memory Files
Coding agents automatically load project memory files such as CLAUDE.md at the start of every session and treat them as trusted project guidance. Anyone who can change such a file, for example through a pull request, can therefore steer the agent without ever touching the developer's prompt. We study memory files as an attack surface for insecure code generation and ask (1) whether a malicious memory file makes agents produce code that passes its tests but is vulnerable, and (2) whether agents disclose to the developer that the file shaped their code. For each of 12 CWE classes, we crafted two malicious memory files, a qualified variant that presents removing defensive checks as engineering best practice and a forceful variant that demands it. We ran Claude Code (Sonnet 5.5) and OpenCode (Qwen 3.8 27B, DeepSeek V4.1 Flash) on 36 SecRepoBench tasks with and without these files. The malicious files changed the rate of secure completions by -8 to +6 percentage points, with no consistent pattern across agents or variants. Agents differ sharply in what they tell the developer about the file. Claude Code names it in about two thirds of its final messages, whereas OpenCode mentions it almost exclusively in its reasoning trace, not in the final message the developer reads. Flagging the file as an attack does not reliably protect the code, as such agents still generated vulnerable code. We outline the larger studies needed to quantify this risk across agents and to design defenses.
