← Catalog
Research high discovered 2025-03-18

Rules File Backdoor: Poisoning AI Coding-Assistant Config

Hidden, obfuscated instructions planted in a shared 'rules file' silently steered AI coding assistants like Cursor and GitHub Copilot to inject malicious code — a supply-chain backdoor invisible in normal review.

Initial Access Persistence Defense Evasion Execution

What happened

Catalogued by MITRE ATLAS as AML.CS0041, Pillar Security showed that adversaries can backdoor AI-generated code by poisoning the “rules files” that configure assistants like Cursor and GitHub Copilot. These shared config files silently guide how the assistant writes code — so instructions hidden inside them (using invisible unicode and obfuscation) steer the assistant to inject malicious code while looking blank to a human reviewer.

Because a rules file is typically checked into a repo and trusted implicitly, a single poisoned file propagates the backdoor to every developer and every generation that uses it — a supply-chain compromise operating through the assistant’s configuration rather than its prompt.

Why it maps to ATLAS

  • AML.T0010.001 — AI Supply Chain Compromise: AI Software: the assistant’s config supply chain is poisoned.
  • AML.T0081 — Modify AI Agent Configuration: the rules file changes how the assistant behaves.
  • AML.T0068 — LLM Prompt Obfuscation: hidden/invisible characters conceal the instructions.
  • AML.T0051.000 — LLM Prompt Injection: Direct: the config injects instructions into the assistant.
  • AML.T0067 — LLM Trusted Output Components Manipulation: the assistant emits attacker-chosen code as trusted output.

Detection notes

Treat rules/config files as security-sensitive artifacts. Scan them for zero-width and bidirectional unicode, render config in a canonical visible form before trusting it, and keep humans in the loop on AI-generated code. A config file that produces behavior not visible in its plain text is the tell.

Detection

Log sources

  • Rules/config file change review (.cursorrules, copilot config)
  • Invisible-unicode / hidden-character scans
  • AI-generated code diff review

Signals

  • Zero-width or bidirectional unicode hidden in rules/config files
  • Coding assistant emitting instructions not present in visible config
  • Generated code containing unrequested logic across a repo

Mitigations

  • Review rules/config files as security-sensitive; scan for hidden characters
  • Render config in a canonical, visible form before trusting it
  • Human review of AI-generated code; provenance on shared rule files