Threat
Invisible Unicode in a Rules File Made Copilot and Cursor Write a Backdoor. Find It
First reported · Discovered dev.to
Page published
Earliest dated coverage: 18 Mar 2025 · First observed: 31 Oct 2026 · Latest dated coverage: 18 Mar 2025
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Rules-file prompt injection can turn repository configuration into a code-generation backdoor whose hidden instructions evade ordinary visual review and persist through project forks.
Pillar Security’s “Rules File Backdoor” demonstration used invisible Unicode characters to hide instructions in coding-assistant rules files, causing Cursor and GitHub Copilot to insert an attacker-controlled script into generated HTML. The hidden instructions framed the script as a security requirement and told the assistants not to mention the change.