AI 编码客户端正在互相读取彼此的个人指令

受控测试发现，Muse Code、GitHub Copilot CLI、OpenCode 和 Grok 在默认远程请求中发送了为竞争性 AI 客户端编写的个人规则。Claude、Gemini 和 Kimi 选择了更窄的边界，这与“自动跨客户端加载是行业标准”的说法相矛盾。Cursor 打包的代码则将这一担忧扩展到了技能层面。

By · Published · Updated

RUNTIMEWIRE INVESTIGATION — Original analysis

Original reporting by RuntimeWire, based on documents, testing, data analysis.

为何重要

代码代理正在将主目录配置转变为可移植的提示上下文。在未在传输前获得批准的情况下，切换工具可能会暴露超出开发者所选工作区的指令。

Reporting record

Finding

Controlled tests found Muse Code, GitHub Copilot CLI, OpenCode and Grok sending personal rules written for competing AI clients with default remote requests.

How we verified

Methods: documents, testing, data analysis.

Reproduction

Reproduction does not apply to this reporting (document-driven).

Company response

RuntimeWire requested comment; the company had not responded by publication time.

Illustration of personal configuration files being exchanged between competing coding clients such as Muse Code, GitHub Copilot CLI, OpenCode and Grok, with Claude, Gemini and Kimi nearby.

GitHub Copilot CLI 不应该知道哪个果园已被批准。

RuntimeWire 已将答案 —— COPILOT-CLAUDE-ORCHARD-5186 —— 放在测试用户主目录下的 ~/.claude/CLAUDE.md，即 Claude Code 的个人指令文件中。所选工作区是空的。基准运行返回了 None。

在下一次默认运行中，Copilot 加载了 Claude 文件，在第一个远程提示中包含了其指令并精确返回了被植入的字符串。当 RuntimeWire 使用 Copilot 的 --no-custom-instructions 开关重复该提示时，该文件被排除，答案又回到 None。非交互式默认运行在传输前没有显示任何通知。

这一结果延续了 RuntimeWire 在 8 月 9 日对 Meta 的 Muse Code 的调查。该报道显示 Muse 默认在其第一次请求中放入完整的个人 Codex 和 Claude 指令。这促使我们将测试范围扩大到其他编码代理。…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.