STUPID-2026-0028
Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code
Why 8/10
Poisoned rule files could make assistants emit malicious code for anyone using them. Demonstrated by researchers; real-world victims are not documented.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Generate code in a project that contains a shared rules/configuration file.
Expected behavior
Ignore invisible or adversarial instructions embedded in configuration files; generate code only from the developer's visible intent.
Actual behavior
Copilot and Cursor obeyed hidden instructions injected into rule files using invisible Unicode characters, silently generating backdoored code that looked legitimate. The hidden characters stayed invisible during pull-request review, and once a poisoned rule file entered a repo it corrupted every future code-generation session for the whole team.
Damage
Pillar Security disclosed the technique to Cursor (Feb 26, 2025) and GitHub (Mar 12, 2025); both responded that users are responsible for reviewing AI-generated code. Malicious instructions survived project forking, so downstream dependencies and end users were also exposed.
Full write-up
Researchers at Pillar Security disclosed a technique they named the 'Rule Files Backdoor' affecting GitHub Copilot and Cursor. By embedding hidden instructions — using invisible Unicode characters and other evasion tricks — into the innocuous rule/configuration files these agents read, an attacker could silently steer them into generating malicious code that appeared legitimate to reviewers. The hidden characters remained invisible during pull-request approval, and once a poisoned rule file entered a repository it corrupted all future code-generation sessions for every team member. The malicious instructions survived forking, propagating to downstream dependencies and end users. With the vast majority of enterprise developers using AI coding tools, the propagation potential was significant. Both vendors, notified in early 2025, replied that users bear responsibility for reviewing AI-generated suggestions.
Classification
- Agent
- GitHub Copilot
- Failure mode
- Security Vulnerability
- Root cause
- Instruction Misunderstanding
- Domain
- Backend
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI04 Agentic Supply Chain Vulnerabilities list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0028: Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0028/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0027By IDSTUPID-2026-0029 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.