Prompt injection in coding assistants: rules files, issues and repositories

What a coding agent reads

Modern assistants such as Cursor and GitHub Copilot accept rules files, project-level instructions that shape how the assistant writes code, which are often shared between teams and copied from public repositories. Agents that work through GitHub read issues, comments, commit messages and other repositories to complete a task. Tool output comes back as text too: a failing test’s log, a linter’s message, a fetched documentation page. The model receives all of it in one stream, and, as the UK National Cyber Security Centre observed in December 2025, nothing inside a language model separates the instructions it was given from the text it is reading.

The consequence is that a repository is an attack surface in the same way an inbox is. Anyone who can file an issue, comment on a pull request, publish a package or contribute a rules file can put text in front of the agent, and the agent will read it with the authority of whoever is running it.

The Rules File Backdoor

On 18 March 2025 Pillar Security disclosed what it called the Rules File Backdoor, affecting Cursor and GitHub Copilot. The attack places instructions in a rules file using invisible Unicode characters, zero-width joiners and bidirectional markers, so that a developer reviewing the file sees ordinary guidance while the model reads an additional set of directions. In Pillar’s demonstration the hidden instructions told the assistant to add an externally hosted script or a weakened implementation to generated code and to say nothing about it in the chat. As they put it, the malicious code propagates silently, with no trace in the chat history or coding logs that would alert a security team.

The vendors’ initial position was that rules files are the user’s responsibility, which is reasonable as far as it goes and unhelpful for a file copied from a popular template. GitHub added a warning when a file contains hidden Unicode text in May 2025. The durable lesson is that a rules file is code: it changes what the tool does, and it deserves the same review, provenance and diff discipline as anything else merged into a repository.

Issues that steer agents: the GitHub MCP case

On 26 May 2025 Invariant Labs published an attack on agents using GitHub’s MCP server, the integration that lets an assistant read and act on repositories. An attacker files an issue in a public repository. A developer later asks their agent to review open issues. The agent reads the malicious one, follows its instructions, gathers content from the developer’s private repositories and publishes it through a pull request. Invariant named the pattern a “toxic agent flow”: indirect prompt injection that triggers a sequence of otherwise legitimate tool calls.

Invariant was explicit that the fault was not in the MCP server’s code but in the architecture that lets untrusted content drive privileged tools, and that model alignment alone does not fix it. Their mitigations were runtime controls: scope the agent’s access to the specific repositories a task needs, and monitor the agent’s interactions with its tools so an unexpected read of a private repository is visible as it happens. Both are versions of the principle Willison calls avoiding the lethal trifecta: an agent with private data, untrusted input and a way to publish is exposed by design.

An older lesson: Trojan Source

Hidden characters in code predate AI assistants. In 2021 Boucher and Anderson disclosed Trojan Source, in which bidirectional override characters inside comments and strings make a reviewer see a different program from the one the compiler builds; it received CVE-2021-42574. Their recommended defences, compiler warnings for unterminated bidirectional controls and editors that render the controls visibly, were adopted by several toolchains and code-hosting interfaces. The Rules File Backdoor is the same defect one layer up: the reader that was fooled is the model rather than the compiler, and the fix is the same, which is to make the invisible visible before anything acts on it.

Habits that catch it

Treat rules and instruction files as code. Review their diffs with invisible characters shown, pin third-party rules to a reviewed version, and reject files containing zero-width or bidirectional characters that the content does not need. Scope the tokens an agent holds to one repository and one task, following Invariant’s advice, and never let an agent publish without a person looking at the diff. Log every tool call, so that when a review goes wrong you can see what the agent read and what it did next.

Before pasting an issue, a README, a log or a documentation page into an assistant, read it the way the model will. The scanner on this site tokenises Markdown and HTML without rendering, separates visible text from comments, hidden elements and link destinations, reveals zero-width, bidirectional and default-ignorable characters as named tokens with their positions, and reports instruction-shaped passages with the channel they were found in. It does not know which repositories your agent can reach, and a clean result does not make an agent safe to run unsupervised. Detection helps you decide what to hand over; the scoping and the approval step are what protect you when something gets through.