Rules File Backdoor

Not on the live ticker since 20 September 2026. The ticker holds at most four campaigns and is for what is happening now. This is a technique with no campaign timeline, so it made room for the skills campaign on the agent skills page. Nothing about the risk changed: C19 and its twins still flag hidden Unicode in agent rules on every roster, and this page stays as the record.

What this is. Instructions hidden inside the configuration files AI coding agents read — CLAUDE.md, .cursorrules, MCP server definitions — using Unicode that renders as nothing. A human reviewing the diff sees ordinary guidance. The agent reads the hidden text and acts on it.

Why it works

Code review is a visual process. Bidirectional overrides, zero-width joiners, tag characters and variation selectors occupy no visible space, so a line can carry a second meaning that the reviewer never sees and the model reads plainly. The attack does not need a vulnerability. It needs a file that a human skims and an agent obeys.

The files that fit that description are exactly the ones a repository adds to make itself easier to work with, which is why they are rarely read closely.

What the checks look for

C18 — agent configuration present. The repository ships instructions intended for an AI agent. Not a fault on its own; it establishes that there is something to hide text in.
C19 — hidden Unicode. A scan of those files for characters that render as nothing. This is the check that catches the technique itself.
C20 — MCP shell launch. An MCP server definition that starts a shell process.
C21 — credential redirect. Configuration that points authentication somewhere other than where it claims.

Reading a finding

C19 reports the file and the position, never the decoded instruction. Rendering hidden text back into a report simply moves the payload to a second surface. If you want to see what was hidden, open the file with a tool that shows codepoints.

The wider picture — every file an agent loads, the other ways text in them gets past review, and the checks you can run by hand — is the explainer CLAUDE.md and README injection.

The related exposure: how the repository reached you

This technique is aimed at agents, and agents are increasingly how developers discover repositories in the first place. C22 records when a repository was reached from an AI surface, because a repository recommended by an agent and carrying instructions for an agent is a different proposition from the same repository found through search. That correlation is only observable in the browser at the moment of navigation.

Add RepoGates to Chrome or Edge How the checks work