cyber.hendryadrian.com
Security Insights · toxsec.com

Pillar Security Demonstrates Hidden-Unicode Backdoor Risk in AI Coding Rules Files

· Original article ↗

Summary

Pillar Security demonstrated how invisible Unicode instructions in shared AI coding rules files could prompt tools such as Cursor and GitHub Copilot to generate malicious code. The article also says explicit security constraints reduce insecure coding patterns.

Key points

  • The article says AI coding tools can reproduce insecure patterns found in public code, including unsanitized input, concatenated SQL queries, and weak password hashing.
  • A controlled comparison found that specific security constraints reduced categories of coding flaws; vague instructions to act as a security expert did not consistently help.
  • Persistent repository instruction files can apply security requirements across code-generation requests, but are also committed, shared, and forked.
  • In March 2025, Pillar Security demonstrated the Rules File Backdoor, which uses invisible Unicode characters to hide instructions in AI coding rules files.
  • The hidden instructions could direct models to add malicious code, disable security checks, or exfiltrate credentials; one demonstration instructed the AI to add a script tag to generated HTML.
  • The article reports that Cursor and GitHub Copilot placed responsibility on users to review AI-generated suggestions.
  • A poisoned rules file could spread through project forks, according to the article.

Article Details

Topic
The Rules File Backdoor attack uses invisible Unicode instructions in AI coding rules files to make coding assistants generate malicious code or exfiltrate data.

Vendors

CursorAttackers can poison those rules files with invisible Unicode to instruct models to inject backdoors and exfiltrate data, as demonstrated by Pillar Security against Cursor and GitHub Copilot.GitHubAttackers can poison those rules files with invisible Unicode to instruct models to inject backdoors and exfiltrate data, as demonstrated by Pillar Security against Cursor and GitHub Copilot.

Products

CursorAttackers can poison those rules files with invisible Unicode to instruct models to inject backdoors and exfiltrate data, as demonstrated by Pillar Security against Cursor and GitHub Copilot.GitHub CopilotAttackers can poison those rules files with invisible Unicode to instruct models to inject backdoors and exfiltrate data, as demonstrated by Pillar Security against Cursor and GitHub Copilot.

Related Articles