2025-03-18 · 2025-Q1
Rules File Backdoor Attack on Cursor and Copilot
Who wrote the file that runs on open?
- Fixable
- Architectural
- Vendor response
- Not a vulnerability
- In the wild
- No
- Actor
- Attacker
Target
Cursor IDE, GitHub Copilot
Impact
Malicious code injected silently into AI-generated output; invisible Unicode characters bypass code reviews
Root cause
AI config files parsed by AI but invisible to human reviewers due to Unicode obfuscation
Sources
Catalog
Cite this: AgentProv incident record: Rules File Backdoor Attack on Cursor and Copilot (2025-03-18). https://agentprov.com/incidents/2025-03-18-rules-file-backdoor-attack-on-cursor-and-copilot
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config