Incident file · Security
The config file that writes vulnerable code on purpose (2025)
hidden instructions in configuration, no special access required
The system
AI coding assistants like GitHub Copilot and Cursor read "rule files" (Cursor's .cursor/rules, Copilot's custom instructions) into the model's context to steer code generation: house style, preferred libraries, architectural conventions. Teams commonly share rule files across projects, sometimes pulling them from a shared internal repository so every project gets the same conventions.
What was observed
Pillar Security disclosed in March 2025 that these rule files could be made to carry hidden instructions, including invisible Unicode characters, that silently steered the agent into generating code with planted vulnerabilities or data-exfiltration logic (leaking environment variables, database credentials, API keys), while the generated code looked legitimate to a human reviewer.
Stop and think
- A rule file is configuration, not code. What does your team's review process actually apply to configuration files versus to the code those files influence?
- If an instruction in a rule file is invisible (hidden Unicode, unusual formatting), what would a normal code review catch, and what would it miss entirely?
- If a corporate rule-file repository is shared across many projects, what happens to every downstream project the moment that one shared file is poisoned?
Answer the questions above before you read on: what failed, why, and what would have stopped it.