Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code

Researchers at Pillar Security disclosed a technique they named the 'Rule Files Backdoor' affecting GitHub Copilot and Cursor. By embedding hidden instructions — using invisible Unicode characters and other evasion tricks — into the innocuous rule/configuration files these agents read, an attacker could silently steer them into generating malicious code that appeared legitimate to reviewers. The hidden characters remained invisible during pull-request approval, and once a poisoned rule file entered a repository it corrupted all future code-generation sessions for every team member. The malicious instructions survived forking, propagating to downstream dependencies and end users. With the vast majority of enterprise developers using AI coding tools, the propagation potential was significant. Both vendors, notified in early 2025, replied that users bear responsibility for reviewing AI-generated suggestions.