# Hidden Unicode in Agent Instruction Files (EDR Graph)

- **Severity:** Medium
- **Signature ID:** `78b34f4d-5fde-57a5-905d-00fd92ed359c-p`
- **MITRE ATLAS:** AML.T0081 (Modify AI Agent Configuration), AML.T0068 (LLM Prompt Obfuscation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), ASI09 (Traceability and Accountability Gaps)

## Summary

AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior, and this rule catches the case where that write happens indirectly, through a subprocess the agent itself spawned, rather than through the agent's own file-write tool call.

## How the attack works

An agent spawns a subprocess, such as a generated script, a `sed -i` command, or a package's postinstall hook. That subprocess writes or creates a file the agent will later read as instructions. Because the write comes from a child process rather than the agent's own tool call, normal detection that watches the agent's actions misses it; this detection instead watches file write/create activity across the whole process tree the agent spawned. The write has already completed by the time this is observed, so it is a detection of what happened, not a block.

## Why it matters

An attacker who can get a subprocess to write to an agent's instruction file can plant hidden Unicode content that silently changes how the agent behaves on future tasks, without ever triggering the agent's own file-write monitoring.

## What you can do

- Treat agent instruction files (CLAUDE.md, .cursorrules, similar) as sensitive config: put them under version control and review diffs before merge.
- Restrict what subprocesses spawned by an agent are allowed to write to, especially near instruction files.
- Audit instruction files periodically for non-printing or unusual Unicode characters, not just visible content.
- Treat alerts from this detection as after-the-fact evidence; investigate what the subprocess was and why it wrote to that file rather than expecting the write to have been blocked.

## Known benign look-alikes

- A developer editing CLAUDE.md or .cursorrules in their own editor while the agent process is the monitored ancestor of that editor
- Repository checkout or branch switch rewriting instruction files
- Formatter or pre-commit hook rewriting the file in place

---
Source: https://www.netzilo.com/threats/rules-file-backdoor-periodic