Check C19 · agent surface family · severity CRITICAL · automatic · one of the 22 checks
The question this check asks: do the files an AI coding agent reads at the start of a session — CLAUDE.md, AGENTS.md, .cursorrules, an MCP configuration — contain characters that render as nothing?
Code review is a visual process, and these files are written to be skimmed. The Rules File Backdoor, published by Pillar Security in March 2025, puts instructions inside an agent's rules file using codepoints that occupy no visible space — zero-width joiners, bidirectional overrides, the Unicode Tags block. The reviewer sees ordinary guidance and approves the pull request. The model reads the hidden text and does what it says. It needs no vulnerability, only a file a person skims and an agent obeys; both Cursor and GitHub initially declined responsibility for it.
The files that fit that description are the ones every serious repository now ships: in our Phase 0 controls, 77 of the 80 most popular repositories carried an agent instruction file. That is why having one costs nothing and what is inside it is the check.
C19 fetches the agent files a repository ships — CLAUDE.md, AGENTS.md, .cursorrules, .clinerules, .windsurfrules, .github/copilot-instructions.md, .cursor/rules/*.mdc, .mcp.json, .cursor/mcp.json and the .claude/ settings files — and scans each for codepoints in U+200B–U+200F, U+202A–U+202E, U+2060–U+2064, U+2066–U+2069, U+FEFF and U+E0000–U+E007F. Any hit is CRITICAL, costs 45 points, and makes the verdict BLOCK; the default personal policy blocks on it, and strict organisation profiles lock that so no policy edit can lower it. The finding names the file, the count and the codepoint names — “3 invisible codepoints (ZERO WIDTH JOINER, RIGHT-TO-LEFT OVERRIDE) — Rules File Backdoor technique; instructions hidden from human review” — and never the decoded text. The evidence note in the scoring table:
“Rules File Backdoor; zero FPs observed”
The presence of the file itself is a separate row, agent-config, weighted at 0 points for the reason above: “77/80 top repos ship CLAUDE.md/AGENTS.md in 2026 — presence is not signal”.
None observed — across the 80 popular, 50 young and 20 binary-shipping control repositories, no legitimate agent file contained a codepoint in the set. The one we expect to see eventually is a byte-order mark (U+FEFF) at the top of a file saved by a Windows editor. If that fires on yours, the finding will say exactly one codepoint, ZERO WIDTH NO-BREAK SPACE, at the start of the file — and we would like to hear about it, because it decides whether a BOM at offset zero should be exempted.
It scans the files on the list. A rules file under a name we do not know, or one added to the repository after you downloaded it, is not read. It looks for invisible characters: homoglyphs — letters from another script that look like Latin ones — are a different technique and are not caught here, and neither is an instruction hidden in plain, readable prose that a reviewer would have to think about rather than see. And it reads the repository's files, not your agent's own configuration outside it.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. A rules file that reaches your machine by clone is not seen by this check; the tools in the next section run on a clone and are the right answer there.
Without installing anything: open the file in an editor that renders invisible characters — VS Code highlights them by default, and GitHub's own file view shows a warning for bidirectional characters, though only those. From a terminal, on any of the files above:
perl -ne 'print "$ARGV:$.: $_" if /[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]/' CLAUDE.md AGENTS.md .cursorrulesFor a whole tree, the open-source anti-trojan-source scanner and SonarQube's rules S6389 and S7628 cover the same codepoints, and Pillar publishes a free rules-file scanner. Those run on what you already have; this check runs before the download.
My repository has a CLAUDE.md — does that fire this check? No. Having an agent instruction file costs 0 points — 77 of the 80 most popular repositories ship one in 2026, so presence is not a signal. C19 reads what is inside the file, and fires only on codepoints that render as nothing: zero-width characters, bidirectional overrides, invisible operators, the Unicode Tags block.
Can I see what was hidden? Not from the finding, deliberately. It names the file, the number of invisible codepoints and their Unicode names — never the decoded text, because rendering a hidden instruction into a report moves the payload to a second surface. Open the file in an editor that shows codepoints, or run the one-line scan on this page.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP and release-asset archives. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. A rules file that reaches your machine by clone is not seen by this check.
C18 Agent config files — the files this check reads; presence alone is 0 points · C20 MCP shell-launch config — the same files, a different payload: a command that fetches and runs · C22 AI-agent provenance — a repository carrying instructions for an agent and recommended by one.
Add RepoGates to Chrome Pricing
Numbers on this page: Pillar Security, March 2025 (the technique); Phase 0 controls of 2026-08-14 (150 repositories, zero hits; 77/80 carrying agent files); weights from the product's scoring table; codepoint ranges from the repository vetting standard.