Security researchers have uncovered a novel supply chain attack called “Rules File Backdoor” that specifically targets AI-powered code editors including GitHub Copilot and Cursor. This vulnerability allows attackers to secretly inject malicious code into software projects.

According to Ziv Karliner, CTO at Pillar Security, the attack works by embedding hidden malicious instructions within configuration files used by these AI coding assistants. The technique leverages invisible Unicode characters and sophisticated evasion methods that manipulate the AI into generating compromised code that can easily bypass standard code review processes.

What makes this attack particularly dangerous is its ability to silently propagate across projects. The vulnerability exploits rules files—normally used to guide AI behavior and define coding practices—by embedding crafted prompts that cause the AI to generate code containing security flaws or backdoors.

Attackers can accomplish this through several methods:
– Using zero-width joiners and other invisible characters to hide malicious instructions
– Employing bidirectional text markers to conceal harmful code
– Exploiting the AI’s natural language processing to generate vulnerable code
– Creating semantic patterns that trick the model into bypassing safety constraints

Both Cursor and GitHub were notified in February and March 2024. Their response emphasized that users remain responsible for reviewing and accepting AI-generated suggestions.

“This attack effectively turns the developer’s most trusted assistant into an unwitting accomplice,” Karliner warned. Once a compromised rules file enters a project repository, it affects all future code generation by team members and can survive project forking, creating a dangerous vector for supply chain attacks that potentially impacts millions of end users through compromised software.