Hidden Unicode in a rules file steers generated code
Pillar Security's "Rules File Backdoor" hides instructions in Cursor and Copilot rules files using invisible Unicode characters.
- Agents
- Cursor, GitHub Copilot
- Reported
- Source checked
- Tags
- rules-files, unicode, supply-chain
Symptom
Generated code includes scripts or behaviour nobody asked for, and the rules file looks clean when you read it.
Cause
Rules files are trusted instructions. Invisible Unicode characters can carry payloads that humans and reviewers don't see but the model reads.
Fix
Treat rules files like code: review and pin them, and scan for invisible or bidirectional Unicode in CI before they reach an agent.
# Fail on zero-width, bidi or tag characters in agent rules files
grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{E0000}-\x{E007F}]' \
.cursorrules .cursor/ .github/copilot-instructions.md AGENTS.md CLAUDE.md 2>/dev/null \
&& exit 1 || true