'Rules File Backdoor': Invisible Unicode in a Shared Config Can Make Cursor and Copilot Write Malicious Code
- Date
- Mar 2025
- Tools involved
- Cursor, github-copilot
- Impact
- Both Cursor and GitHub Copilot could be steered to insert backdoored code. A single poisoned rules file shared via templates or pull requests could compromise many downstream projects while passing human review.
- Root cause
- Rules and instruction files that guide the AI can carry invisible Unicode (zero-width joiners, bidirectional markers) that humans cannot see but the model reads and obeys as legitimate instructions.
What happened
In March 2025, Pillar Security disclosed a supply-chain attack it named the 'Rules File Backdoor,' affecting the AI coding assistants Cursor and GitHub Copilot. Both tools let developers supply 'rules' or instruction files that shape how the AI generates code, and those files are routinely shared across teams, projects, and public repositories.
Pillar showed an attacker could hide invisible Unicode characters, such as zero-width joiners and bidirectional markers, inside a rules file. The characters render as nothing to a human reviewer but are fully readable by the model. That let hidden instructions steer the AI into inserting malicious code, for example a reference to a backdoored script, into otherwise normal output.
The danger is distribution. Poisoned rules files can spread through developer forums, pull requests, starter templates, and corporate knowledge bases, so a single tainted file can quietly compromise many downstream projects while passing human review, because the malicious instructions are literally invisible on screen.
Pillar disclosed to Cursor in February 2025 and to GitHub in March 2025. Both responded that reviewing and accepting AI-generated suggestions is the user's responsibility rather than a platform vulnerability. The Hacker News, SC Media, and others covered it as an early demonstration of instruction-file poisoning in AI development workflows.
Impact
Both Cursor and GitHub Copilot could be steered to write backdoored code by a rules file that looked clean to a human. Because these instruction files are shared through templates, pull requests, and knowledge bases, one poisoned file could propagate a hidden backdoor across many projects. There is no public tally of exploited victims; the significance is the technique and how well it evades review.
Root cause
Rules and instruction files that guide AI coding assistants are treated as trusted configuration, but they can carry invisible Unicode such as zero-width joiners and bidirectional markers. Humans see nothing unusual, while the model reads and obeys the hidden text. So a reviewer can approve a file that is, to the AI, full of instructions to insert malicious code. Both Cursor and GitHub framed accepting AI output as the user's responsibility rather than a platform bug, which leaves the burden on review.
How to not be this entry
- Review rules and instruction files as carefully as source code, and know they can contain characters you cannot see. Do not paste a rules file from a forum or template into your project on trust.
- Scan configuration and instruction files for invisible or bidirectional Unicode before adopting them. Zero-width and bidi characters have no legitimate place in a rules file.
- Read the code the AI actually produces, not just its summary. This attack works precisely because the malicious instruction is invisible and the output looks normal, so diff review is your backstop. Read the fix guide: SQL injection and XSS in AI-generated code
- Treat shared AI config as a supply-chain dependency. A tainted starter template or pull request can carry a hidden backdoor into many projects at once. Read the fix guide: Slopsquatting: the AI hallucinated an npm package and an attacker registered it
Tools that actually fix this
Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.
Snyk Code catches injection and XSS right in your editor, and Snyk Open Source flags vulnerable and malicious packages. It covers several AI-code failure modes at once and is free for open source.
Try Snyk →All-in-one appsec (code scanning, dependencies, secret detection, containers) with low-noise output, built for small teams that cannot run five separate tools. One dashboard covers several failure modes.
Try Aikido Security →Frequently asked questions
What is the 'Rules File Backdoor' attack?
The Rules File Backdoor is a supply-chain attack disclosed by Pillar Security in March 2025 that affects Cursor and GitHub Copilot. An attacker hides invisible Unicode characters inside the 'rules' or instruction files that guide these AI assistants, so hidden instructions steer the AI into inserting malicious code while a human reviewer sees nothing wrong.
How can invisible characters change what the AI writes?
Rules files can contain characters like zero-width joiners and bidirectional markers that render as nothing on screen but are fully readable by the model. Because the AI reads the hidden text as legitimate instructions, it can be directed to insert a backdoor, such as a reference to a malicious script, into otherwise normal-looking output that passes human review.
How did Cursor and GitHub respond?
Pillar Security disclosed the issue to Cursor in February 2025 and to GitHub in March 2025. Both companies responded that reviewing and accepting AI-generated suggestions is the user's responsibility rather than a platform vulnerability, which places the burden of catching poisoned rules files on the developer.
How do I protect my team from poisoned rules files?
Treat shared rules and instruction files as untrusted supply-chain dependencies. Scan them for invisible or bidirectional Unicode before adopting them, avoid pasting rules files from forums or templates on trust, and always review the actual code the AI produces rather than its summary, since that diff is your backstop against an invisible instruction.
Sources
- Pillar Security: Rules File Backdoor in GitHub Copilot and Cursor
- The Hacker News: New 'Rules File Backdoor' attack targets AI code editors
- SC Media: How AI coding assistants could be compromised via a rules file
Related error guides
SQL injection and XSS in AI-generated code
Slopsquatting: the AI hallucinated an npm package and an attacker registered it
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.