Pillar Security discloses 'Rules File Backdoor' attack on AI coding assistants

Security researchers at Pillar Security disclosed a technique they called the “Rules File Backdoor,” a supply-chain attack against AI coding assistants including Cursor and GitHub Copilot. Both tools let developers place project-wide instructions in a “rules” file — Cursor’s .cursor/rules, and Copilot’s equivalent — that steer how the assistant generates code across a repository. Pillar showed that an attacker could poison one of these files with hidden zero-width and bidirectional-text Unicode characters: invisible in a code editor or a GitHub pull-request diff, but readable by the AI model, which would follow the concealed instructions when generating code.

Pillar’s proof of concept combined the hidden text with a jailbreak-style narrative framing the injected instructions as legitimate requirements, plus a further instruction telling the model to omit any mention of the change from its chat output — so a developer reviewing the assistant’s summary would see nothing amiss. The result, Pillar argued, was a way to smuggle vulnerabilities or data-exfiltration code into a project that would pass ordinary code review because the payload was never visible to a human reader.

Pillar disclosed the issue to Cursor in late February 2025 and to GitHub in mid-March; both initially treated it as a user-responsibility issue rather than a platform vulnerability, since the rule files were themselves collaborator-editable content. GitHub subsequently added a warning for hidden Unicode text in its interface. The disclosure was one of the earlier documented cases of prompt injection reaching from a configuration file into an AI coding agent’s output, a pattern that recurred as agentic coding tools were given wider write access to codebases.