Hidden Unicode in Agent Instruction Files

How the attack works

An attacker writes or edits an agent instruction file (CLAUDE.md, .cursorrules, .windsurfrules, copilot-instructions.md, or files under .cursor/rules/) and inserts zero-width characters or bidirectional text-override codepoints. These characters render as blank or reorder visible text in most editors, so a code reviewer approves the change without noticing anything unusual. The AI agent, however, processes the raw text including the hidden characters, so it can be steered by instructions the human never saw. Because the file is committed to the repository, the hidden instructions persist across every future session and follow the repo to anyone who clones it.

Netzilo detection

Why it matters

An attacker gains a standing, hard-to-spot channel for injecting instructions into an AI coding agent, effective every time the repo is opened, and able to spread to other users of the same repository.

What you can do

• →Review agent instruction files (CLAUDE.md, .cursorrules, .windsurfrules, copilot-instructions.md, .cursor/rules/) for non-printing or bidi-control Unicode characters, not just visible content.
• →Use a diff or linter that highlights zero-width characters (U+200B, U+200C, U+200D, U+FEFF) and bidi override marks (U+202A-U+202E, U+2066-U+2069) instead of relying on visual review alone.
• →Treat legitimate right-to-left language content and BOM markers as expected exceptions, but confirm the surrounding text matches the file's stated purpose.
• →Restrict who can commit changes to agent instruction files and require review specifically for these paths.

Known benign look-alikes

• Instruction files that legitimately contain right-to-left natural language (Arabic, Hebrew) — those use bidi marks as text, not as an override
• A file saved with a UTF-8 BOM by an editor, combined with imperative wording
• Emoji sequences that use zero-width joiners in prose examples

References

• https://attack.mitre.org/techniques/T1546/
• https://attack.mitre.org/techniques/T1564/
• https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents

Related threats