Rules File Backdoor

What this is. Instructions hidden inside the configuration files AI coding agents read — CLAUDE.md, .cursorrules, MCP server definitions — using Unicode that renders as nothing. A human reviewing the diff sees ordinary guidance. The agent reads the hidden text and acts on it.

Why it works

Code review is a visual process. Bidirectional overrides, zero-width joiners, tag characters and variation selectors occupy no visible space, so a line can carry a second meaning that the reviewer never sees and the model reads plainly. The attack does not need a vulnerability. It needs a file that a human skims and an agent obeys.

The files that fit that description are exactly the ones a repository adds to make itself easier to work with, which is why they are rarely read closely.

What the checks look for

C18 — agent configuration present. The repository ships instructions intended for an AI agent. Not a fault on its own; it establishes that there is something to hide text in.
C19 — hidden Unicode. A scan of those files for characters that render as nothing. This is the check that catches the technique itself.
C20 — MCP shell launch. An MCP server definition that starts a shell process.
C21 — credential redirect. Configuration that points authentication somewhere other than where it claims.

Reading a finding

C19 reports the file and the position, never the decoded instruction. Rendering hidden text back into a report simply moves the payload to a second surface. If you want to see what was hidden, open the file with a tool that shows codepoints.

The related exposure: how the repository reached you

This technique is aimed at agents, and agents are increasingly how developers discover repositories in the first place. C22 records when a repository was reached from an AI surface, because a repository recommended by an agent and carrying instructions for an agent is a different proposition from the same repository found through search. That correlation is only observable in the browser at the moment of navigation.