Rules File Backdoor vulnerability affects GitHub Copilot and Cursor
Researchers at Pillar Security discovered a supply chain attack called "Rules File Backdoor" that allows attackers to inject malicious instructions into configuration files used by AI coding assistants GitHub Copilot and Cursor. The attack uses obfuscation techniques to hide malicious code that the AI then generates, potentially affecting millions of developers.
What happened
Pillar Security researchers discovered a supply chain attack vector called 'Rules File Backdoor' affecting GitHub Copilot and Cursor AI coding assistants. Attackers can inject malicious hidden instructions into rule files—configuration files that guide AI assistants in generating code—using techniques like unicode obfuscation and contextual manipulation to make changes virtually invisible to human reviewers.
The malicious rule files instruct AI assistants to generate vulnerable or compromised code including unsecured cryptographic algorithms, hidden backdoors, weak authentication flows, and code that exfiltrates sensitive information like API keys, database credentials, or user data. Once poisoned, these rule files could propagate across teams and projects through forks and dependencies.
Demonstrations showed a simple HTML generation request in Cursor led to insertion of a malicious script sourced from an attacker-controlled site, with the payload containing invisible Unicode characters and jailbreak storytelling that developers remained unaware of.
Reported impact
The vulnerability affects GitHub Copilot and Cursor, which collectively serve millions of developers and are integrated into countless enterprise development workflows worldwide. The attack represents a fundamental shift in supply chain security as malicious code blends seamlessly with legitimate AI suggestions while bypassing conventional security controls and code reviews.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.