STUPID-2026-0028

Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code

10.0critical
March 18, 2025Verified

  1. Instruction given

    Generate code in a project that contains a shared rules/configuration file.

  2. Expected behavior

    Ignore invisible or adversarial instructions embedded in configuration files; generate code only from the developer's visible intent.

  3. Actual behavior

    Copilot and Cursor obeyed hidden instructions injected into rule files using invisible Unicode characters, silently generating backdoored code that looked legitimate. The hidden characters stayed invisible during pull-request review, and once a poisoned rule file entered a repo it corrupted every future code-generation session for the whole team.

  4. Damage

    Pillar Security disclosed the technique to Cursor (Feb 26, 2025) and GitHub (Mar 12, 2025); both responded that users are responsible for reviewing AI-generated code. Malicious instructions survived project forking, so downstream dependencies and end users were also exposed.

Researchers at Pillar Security disclosed a technique they named the 'Rule Files Backdoor' affecting GitHub Copilot and Cursor. By embedding hidden instructions — using invisible Unicode characters and other evasion tricks — into the innocuous rule/configuration files these agents read, an attacker could silently steer them into generating malicious code that appeared legitimate to reviewers. The hidden characters remained invisible during pull-request approval, and once a poisoned rule file entered a repository it corrupted all future code-generation sessions for every team member. The malicious instructions survived forking, propagating to downstream dependencies and end users. With the vast majority of enterprise developers using AI coding tools, the propagation potential was significant. Both vendors, notified in early 2025, replied that users bear responsibility for reviewing AI-generated suggestions.

Classification

Agent
GitHub Copilot
Failure mode
Security Vulnerability
Root cause
Instruction Misunderstanding
Domain
Backend
Source
News Report

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.