Disclosed vulnerability
Rules File Backdoor: invisible-Unicode supply chain attack on Cursor and GitHub Copilot rules files
AIR-2025-0015 AIR record · 2025-03-cursor-copilot-rules-file-backdoor
From the supporting source
This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilotpillar.security
The record
Disclosed
2025-03-18
Vendor
Anysphere, GitHub/Microsoft
Product
Cursor, GitHub Copilot
Risk domain
Agent output quality › Hallucination
Also touches
Credential theft, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — the coding agent wrote backdoored code into the repository
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Poisoned configuration file
Impact type
Supply chain compromise, Backdoored code, Malicious code generation, Backdoor insertion, Credential leakage, Supply chain backdoor, Credential leak in generated code
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI08 – Cascading Failures
- MITRE ATLAS
- AML.T0062 – Discover LLM Hallucinations
- NIST AI RMF
- MEASURE 2.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 24029-1
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any repo or template that ships a poisoned rules file, plus downstream forks
Capability abused
Defense & remediation
Recorded defense
human code review
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
GitHub shipped a hidden-Unicode warning (May 2025); Cursor classified it as user responsibility
Taxonomy & references
Curator notes
Pillar Security. Vendors disagreed on ownership: Cursor declined to treat it as a product vulnerability. | Class set to `responsible_disclosure` by hand because the source records disagreed; the override reason is kept in the curation log. Also reported under the titles: 'Rules File Backdoor: invisible Unicode instructions in AI coding-assistant config files'; 'Rules File Backdoor: invisible Unicode instructions in AI coding-assistant rules files poison generated code'.
Supporting sources
Cite as
Enkrypt AI. "Rules File Backdoor: invisible-Unicode supply chain attack on Cursor and GitHub Copilot rules files". AIR, AIR-2025-0015. https://agentincident.vercel.app/i/AIR-2025-0015/ (accessed 2026-10-19).