What it is
Modern AI coding agents — Claude Code, GitHub Copilot, Cursor, and others — read plain-text files sitting in a project’s working directory before they do anything else. These files, commonly named CLAUDE.md, AGENTS.md, or stored in a .cursor/rules directory, are meant to hold mundane project context: build commands, code style, architectural constraints, testing procedures. The agent loads them automatically, by design, every time it starts work in that directory. No one has to tell it to; that is the point of the feature.
AGENTS.md has emerged as an open, cross-tool convention — more than twenty coding agents, including Codex, Cursor, and Gemini CLI, read it, and Claude Code adopted native support for it in September 2026. CLAUDE.md is Anthropic’s own, richer variant with additional features such as path-scoped imports. Industry surveys cited in the security research below put adoption of generative AI coding tools among enterprise developers at roughly 97 percent as of 2024, which gives a sense of how widely this automatic-ingestion behaviour is now deployed.
The behaviour that makes the files useful is the same behaviour that makes them exploitable: the agent cannot easily distinguish a legitimate project instruction from an adversarial one once both arrive as plain text in its context window. Security researchers have termed this class of exploit the “Rules File Backdoor.” An attacker plants a poisoned instruction file — or hides malicious text inside an otherwise innocuous one, using invisible Unicode characters such as zero-width joiners or bidirectional text markers that a human reviewer will not see but the model will parse — and distributes it via a shared repository, a forum post, or a pull request to a popular open-source project. When a developer opens that project in an AI-assisted editor, the agent ingests the hidden instructions as if they were trusted configuration.
Why it matters for AI governance and narratives
This is a useful case study in how “agentic” AI systems generate their own governance problems faster than institutions can name them. The feature exists because builders wanted agents to act with less hand-holding — reading context automatically rather than waiting to be told. That same autonomy removes a human checkpoint that used to catch bad instructions before they reached the model. Academic researchers testing Cursor and GitHub Copilot with an automated framework found attack success rates between 41 and 84 percent and unauthorized command execution in 75 to 88 percent of scenarios, across eleven categories of adversarial technique drawn from the MITRE ATT&CK framework — a sobering gap between the convenience the industry markets and the security assurances it has yet to build.
The pattern also illustrates a recurring theme in this observatory’s coverage of the “attack surface” thread: as agent capability and autonomy are institutionalised — new standards, new industry consortia pooling agent components — the defensive tooling consistently lags the offensive proof-of-concept by months. Responsible-disclosure timelines bear this out: researchers disclosed the rules-file vulnerability to Cursor and GitHub in February–March 2025; GitHub’s mitigation (a warning for hidden Unicode text) did not ship until May 2025, and Cursor’s team concluded the risk sat with the user rather than the product.
Key facts and dates
Pillar Security researchers, led by Ziv Karliner, first published the “Rules File Backdoor” technique on 18 March 2025, demonstrating it against GitHub Copilot and Cursor. A subsequent academic study (Liu, Zhao, Lyu, Zhang, Wang and Lo, affiliated with Singapore Management University, Huazhong University of Science and Technology, and Monash University) built an automated evaluation framework called AIShellJack, testing 314 distinct attack payloads against Cursor v1.2.2 and GitHub Copilot in VS Code v1.102, running on top of Claude 4 Sonnet and Gemini 2.5 Pro. Separately, Trail of Bits documented related “argument injection” techniques in October 2025 that let attackers smuggle malicious flags into commands an agent believes are pre-approved and safe, referencing prior disclosures including a Claude Code vulnerability (CVE-2025-54795) and a Cursor vulnerability (GHSA-534m-3w6r-8pqr).
No single body yet governs this risk. Vendors have responded unevenly — Unicode-hiding warnings in some tools, no change in others — and no regulator has yet issued binding guidance specific to agent instruction files, though the OECD’s AI incident monitor has logged the Rules File Backdoor as a tracked incident.
Where to learn more
- Pillar Security: “New Vulnerability in GitHub Copilot and Cursor” — the original disclosure, including disclosure timeline and technical mechanism
- “Your AI, My Shell”: Demystifying Prompt Injection Attacks on Agentic AI Coding Editors (arXiv:2509.22040) — peer-reviewed quantitative study (AIShellJack framework)
- Trail of Bits: “Prompt injection to RCE in AI agents” — follow-on research on argument injection and coordinated disclosures
- OECD.AI Incident Monitor: “Invisible ‘Rules File Backdoor’ Threatens AI Code Assistants” — intergovernmental incident tracking entry